xref: /btstack/src/ble/sm.c (revision 06e1ef76482a4c9e6c01926f0f9636fff00eff9b)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define __BTSTACK_FILE__ "sm.c"
39 
40 #include <stdio.h>
41 #include <string.h>
42 #include <inttypes.h>
43 
44 #include "ble/le_device_db.h"
45 #include "ble/core.h"
46 #include "ble/sm.h"
47 #include "bluetooth_company_id.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_linked_list.h"
51 #include "btstack_memory.h"
52 #include "gap.h"
53 #include "hci.h"
54 #include "hci_dump.h"
55 #include "l2cap.h"
56 
57 #if !defined(ENABLE_LE_PERIPHERAL) && !defined(ENABLE_LE_CENTRAL)
58 #error "LE Security Manager used, but neither ENABLE_LE_PERIPHERAL nor ENABLE_LE_CENTRAL defined. Please add at least one to btstack_config.h."
59 #endif
60 
61 #if defined(ENABLE_LE_PERIPHERAL) && defined(ENABLE_LE_CENTRAL)
62 #define IS_RESPONDER(role) (role)
63 #else
64 #ifdef ENABLE_LE_CENTRAL
65 // only central - never responder (avoid 'unused variable' warnings)
66 #define IS_RESPONDER(role) (0 && role)
67 #else
68 // only peripheral - always responder (avoid 'unused variable' warnings)
69 #define IS_RESPONDER(role) (1 || role)
70 #endif
71 #endif
72 
73 #ifdef ENABLE_LE_SECURE_CONNECTIONS
74 // assert SM Public Key can be sent/received
75 #if HCI_ACL_PAYLOAD_SIZE < 69
76 #error "HCI_ACL_PAYLOAD_SIZE must be at least 69 bytes when using LE Secure Conection. Please increase HCI_ACL_PAYLOAD_SIZE or disable ENABLE_LE_SECURE_CONNECTIONS"
77 #endif
78 
79 // configure ECC implementations
80 #ifdef ENABLE_LE_SECURE_CONNECTIONS
81 #if defined(ENABLE_MICRO_ECC_FOR_LE_SECURE_CONNECTIONS) && defined(HAVE_MBEDTLS_ECC_P256)
82 #error "If you already have mbedTLS (HAVE_MBEDTLS_ECC_P256), please disable uECC (USE_MICRO_ECC_FOR_ECDH) in bstack_config.h"
83 #endif
84 #ifdef ENABLE_MICRO_ECC_FOR_LE_SECURE_CONNECTIONS
85 #define USE_SOFTWARE_ECDH_IMPLEMENTATION
86 #define USE_MICRO_ECC_FOR_ECDH
87 #endif
88 #ifdef HAVE_MBEDTLS_ECC_P256
89 #define USE_SOFTWARE_ECDH_IMPLEMENTATION
90 #define USE_MBEDTLS_FOR_ECDH
91 #endif
92 #endif /* ENABLE_LE_SECURE_CONNECTIONS */
93 
94 // Software ECDH implementation provided by micro-ecc
95 #ifdef USE_MICRO_ECC_FOR_ECDH
96 #include "uECC.h"
97 #endif
98 #endif
99 
100 // Software ECDH implementation provided by mbedTLS
101 #ifdef USE_MBEDTLS_FOR_ECDH
102 #include "mbedtls/config.h"
103 #include "mbedtls/platform.h"
104 #include "mbedtls/ecp.h"
105 #endif
106 
107 #if defined(ENABLE_LE_SIGNED_WRITE) || defined(ENABLE_LE_SECURE_CONNECTIONS)
108 #define ENABLE_CMAC_ENGINE
109 #endif
110 
111 //
112 // SM internal types and globals
113 //
114 
115 typedef enum {
116     DKG_W4_WORKING,
117     DKG_CALC_IRK,
118     DKG_W4_IRK,
119     DKG_CALC_DHK,
120     DKG_W4_DHK,
121     DKG_READY
122 } derived_key_generation_t;
123 
124 typedef enum {
125     RAU_W4_WORKING,
126     RAU_IDLE,
127     RAU_GET_RANDOM,
128     RAU_W4_RANDOM,
129     RAU_GET_ENC,
130     RAU_W4_ENC,
131     RAU_SET_ADDRESS,
132 } random_address_update_t;
133 
134 typedef enum {
135     CMAC_IDLE,
136     CMAC_CALC_SUBKEYS,
137     CMAC_W4_SUBKEYS,
138     CMAC_CALC_MI,
139     CMAC_W4_MI,
140     CMAC_CALC_MLAST,
141     CMAC_W4_MLAST
142 } cmac_state_t;
143 
144 typedef enum {
145     JUST_WORKS,
146     PK_RESP_INPUT,  // Initiator displays PK, responder inputs PK
147     PK_INIT_INPUT,  // Responder displays PK, initiator inputs PK
148     OK_BOTH_INPUT,  // Only input on both, both input PK
149     NK_BOTH_INPUT,  // Only numerical compparison (yes/no) on on both sides
150     OOB             // OOB available on both sides
151 } stk_generation_method_t;
152 
153 typedef enum {
154     SM_USER_RESPONSE_IDLE,
155     SM_USER_RESPONSE_PENDING,
156     SM_USER_RESPONSE_CONFIRM,
157     SM_USER_RESPONSE_PASSKEY,
158     SM_USER_RESPONSE_DECLINE
159 } sm_user_response_t;
160 
161 typedef enum {
162     SM_AES128_IDLE,
163     SM_AES128_ACTIVE
164 } sm_aes128_state_t;
165 
166 typedef enum {
167     ADDRESS_RESOLUTION_IDLE,
168     ADDRESS_RESOLUTION_GENERAL,
169     ADDRESS_RESOLUTION_FOR_CONNECTION,
170 } address_resolution_mode_t;
171 
172 typedef enum {
173     ADDRESS_RESOLUTION_SUCEEDED,
174     ADDRESS_RESOLUTION_FAILED,
175 } address_resolution_event_t;
176 
177 typedef enum {
178     EC_KEY_GENERATION_IDLE,
179     EC_KEY_GENERATION_ACTIVE,
180     EC_KEY_GENERATION_W4_KEY,
181     EC_KEY_GENERATION_DONE,
182 } ec_key_generation_state_t;
183 
184 typedef enum {
185     SM_STATE_VAR_DHKEY_NEEDED = 1 << 0,
186     SM_STATE_VAR_DHKEY_CALCULATED = 1 << 1,
187     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 2,
188 } sm_state_var_t;
189 
190 typedef enum {
191     SM_SC_OOB_IDLE,
192     SM_SC_OOB_W2_GET_RANDOM_1,
193     SM_SC_OOB_W4_RANDOM_1,
194     SM_SC_OOB_W2_GET_RANDOM_2,
195     SM_SC_OOB_W4_RANDOM_2,
196     SM_SC_OOB_W2_CALC_CONFIRM,
197     SM_SC_OOB_W4_CONFIRM,
198 } sm_sc_oob_state_t;
199 
200 typedef uint8_t sm_key24_t[3];
201 typedef uint8_t sm_key56_t[7];
202 typedef uint8_t sm_key256_t[32];
203 
204 //
205 // GLOBAL DATA
206 //
207 
208 static uint8_t test_use_fixed_local_csrk;
209 
210 #ifdef ENABLE_TESTING_SUPPORT
211 static uint8_t test_pairing_failure;
212 #endif
213 
214 // configuration
215 static uint8_t sm_accepted_stk_generation_methods;
216 static uint8_t sm_max_encryption_key_size;
217 static uint8_t sm_min_encryption_key_size;
218 static uint8_t sm_auth_req = 0;
219 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
220 static uint8_t sm_slave_request_security;
221 static uint32_t sm_fixed_passkey_in_display_role;
222 static uint8_t sm_reconstruct_ltk_without_le_device_db_entry;
223 #ifdef ENABLE_LE_SECURE_CONNECTIONS
224 static uint8_t sm_have_ec_keypair;
225 #endif
226 
227 #ifdef ENABLE_LE_SECURE_CONNECTIONS
228 static uint8_t sm_sc_oob_random[16];
229 static void (*sm_sc_oob_callback)(const uint8_t * confirm_value, const uint8_t * random_value);
230 static sm_sc_oob_state_t sm_sc_oob_state;
231 #endif
232 
233 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
234 static sm_key_t sm_persistent_er;
235 static sm_key_t sm_persistent_ir;
236 
237 // derived from sm_persistent_ir
238 static sm_key_t sm_persistent_dhk;
239 static sm_key_t sm_persistent_irk;
240 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
241 static derived_key_generation_t dkg_state;
242 
243 // derived from sm_persistent_er
244 // ..
245 
246 // random address update
247 static random_address_update_t rau_state;
248 static bd_addr_t sm_random_address;
249 
250 // CMAC Calculation: General
251 #ifdef ENABLE_CMAC_ENGINE
252 static cmac_state_t sm_cmac_state;
253 static uint16_t     sm_cmac_message_len;
254 static sm_key_t     sm_cmac_k;
255 static sm_key_t     sm_cmac_x;
256 static sm_key_t     sm_cmac_m_last;
257 static uint8_t      sm_cmac_block_current;
258 static uint8_t      sm_cmac_block_count;
259 static uint8_t      (*sm_cmac_get_byte)(uint16_t offset);
260 static void         (*sm_cmac_done_handler)(uint8_t * hash);
261 #endif
262 
263 // CMAC for ATT Signed Writes
264 #ifdef ENABLE_LE_SIGNED_WRITE
265 static uint8_t      sm_cmac_header[3];
266 static const uint8_t * sm_cmac_message;
267 static uint8_t      sm_cmac_sign_counter[4];
268 #endif
269 
270 // CMAC for Secure Connection functions
271 #ifdef ENABLE_LE_SECURE_CONNECTIONS
272 static sm_connection_t * sm_cmac_connection;
273 static uint8_t           sm_cmac_sc_buffer[80];
274 #endif
275 
276 // resolvable private address lookup / CSRK calculation
277 static int       sm_address_resolution_test;
278 static int       sm_address_resolution_ah_calculation_active;
279 static uint8_t   sm_address_resolution_addr_type;
280 static bd_addr_t sm_address_resolution_address;
281 static void *    sm_address_resolution_context;
282 static address_resolution_mode_t sm_address_resolution_mode;
283 static btstack_linked_list_t sm_address_resolution_general_queue;
284 
285 // aes128 crypto engine. store current sm_connection_t in sm_aes128_context
286 static sm_aes128_state_t  sm_aes128_state;
287 static void *             sm_aes128_context;
288 
289 // use aes128 provided by MCU - not needed usually
290 #ifdef HAVE_AES128
291 static uint8_t                aes128_result_flipped[16];
292 static btstack_timer_source_t aes128_timer;
293 void btstack_aes128_calc(uint8_t * key, uint8_t * plaintext, uint8_t * result);
294 #endif
295 
296 // random engine. store context (ususally sm_connection_t)
297 static void * sm_random_context;
298 
299 // to receive hci events
300 static btstack_packet_callback_registration_t hci_event_callback_registration;
301 
302 /* to dispatch sm event */
303 static btstack_linked_list_t sm_event_handlers;
304 
305 // LE Secure Connections
306 #ifdef ENABLE_LE_SECURE_CONNECTIONS
307 static ec_key_generation_state_t ec_key_generation_state;
308 static uint8_t ec_d[32];
309 static uint8_t ec_q[64];
310 #endif
311 
312 // Software ECDH implementation provided by mbedtls
313 #ifdef USE_MBEDTLS_FOR_ECDH
314 static mbedtls_ecp_group   mbedtls_ec_group;
315 #endif
316 
317 //
318 // Volume 3, Part H, Chapter 24
319 // "Security shall be initiated by the Security Manager in the device in the master role.
320 // The device in the slave role shall be the responding device."
321 // -> master := initiator, slave := responder
322 //
323 
324 // data needed for security setup
325 typedef struct sm_setup_context {
326 
327     btstack_timer_source_t sm_timeout;
328 
329     // used in all phases
330     uint8_t   sm_pairing_failed_reason;
331 
332     // user response, (Phase 1 and/or 2)
333     uint8_t   sm_user_response;
334     uint8_t   sm_keypress_notification; // bitmap: passkey started, digit entered, digit erased, passkey cleared, passkey complete, 3 bit count
335 
336     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
337     int       sm_key_distribution_send_set;
338     int       sm_key_distribution_received_set;
339 
340     // Phase 2 (Pairing over SMP)
341     stk_generation_method_t sm_stk_generation_method;
342     sm_key_t  sm_tk;
343     uint8_t   sm_have_oob_data;
344     uint8_t   sm_use_secure_connections;
345 
346     sm_key_t  sm_c1_t3_value;   // c1 calculation
347     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
348     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
349     sm_key_t  sm_local_random;
350     sm_key_t  sm_local_confirm;
351     sm_key_t  sm_peer_random;
352     sm_key_t  sm_peer_confirm;
353     uint8_t   sm_m_addr_type;   // address and type can be removed
354     uint8_t   sm_s_addr_type;   //  ''
355     bd_addr_t sm_m_address;     //  ''
356     bd_addr_t sm_s_address;     //  ''
357     sm_key_t  sm_ltk;
358 
359     uint8_t   sm_state_vars;
360 #ifdef ENABLE_LE_SECURE_CONNECTIONS
361     uint8_t   sm_peer_q[64];    // also stores random for EC key generation during init
362     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
363     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
364     sm_key_t  sm_dhkey;
365     sm_key_t  sm_peer_dhkey_check;
366     sm_key_t  sm_local_dhkey_check;
367     sm_key_t  sm_ra;
368     sm_key_t  sm_rb;
369     sm_key_t  sm_t;             // used for f5 and h6
370     sm_key_t  sm_mackey;
371     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
372 #endif
373 
374     // Phase 3
375 
376     // key distribution, we generate
377     uint16_t  sm_local_y;
378     uint16_t  sm_local_div;
379     uint16_t  sm_local_ediv;
380     uint8_t   sm_local_rand[8];
381     sm_key_t  sm_local_ltk;
382     sm_key_t  sm_local_csrk;
383     sm_key_t  sm_local_irk;
384     // sm_local_address/addr_type not needed
385 
386     // key distribution, received from peer
387     uint16_t  sm_peer_y;
388     uint16_t  sm_peer_div;
389     uint16_t  sm_peer_ediv;
390     uint8_t   sm_peer_rand[8];
391     sm_key_t  sm_peer_ltk;
392     sm_key_t  sm_peer_irk;
393     sm_key_t  sm_peer_csrk;
394     uint8_t   sm_peer_addr_type;
395     bd_addr_t sm_peer_address;
396 
397 } sm_setup_context_t;
398 
399 //
400 static sm_setup_context_t the_setup;
401 static sm_setup_context_t * setup = &the_setup;
402 
403 // active connection - the one for which the_setup is used for
404 static uint16_t sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
405 
406 // @returns 1 if oob data is available
407 // stores oob data in provided 16 byte buffer if not null
408 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
409 static int (*sm_get_sc_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_sc_peer_confirm, uint8_t * oob_sc_peer_random);
410 
411 // horizontal: initiator capabilities
412 // vertial:    responder capabilities
413 static const stk_generation_method_t stk_generation_method [5] [5] = {
414     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
415     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
416     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
417     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
418     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
419 };
420 
421 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
422 #ifdef ENABLE_LE_SECURE_CONNECTIONS
423 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
424     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
425     { JUST_WORKS,      NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
426     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
427     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
428     { PK_RESP_INPUT,   NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
429 };
430 #endif
431 
432 static void sm_run(void);
433 static void sm_done_for_handle(hci_con_handle_t con_handle);
434 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
435 static inline int sm_calc_actual_encryption_key_size(int other);
436 static int sm_validate_stk_generation_method(void);
437 static void sm_handle_encryption_result(uint8_t * data);
438 static void sm_notify_client_status_reason(sm_connection_t * sm_conn, uint8_t status, uint8_t reason);
439 #ifdef ENABLE_LE_SECURE_CONNECTIONS
440 static int sm_passkey_entry(stk_generation_method_t method);
441 #endif
442 
443 static void log_info_hex16(const char * name, uint16_t value){
444     log_info("%-6s 0x%04x", name, value);
445 }
446 
447 // static inline uint8_t sm_pairing_packet_get_code(sm_pairing_packet_t packet){
448 //     return packet[0];
449 // }
450 static inline uint8_t sm_pairing_packet_get_io_capability(sm_pairing_packet_t packet){
451     return packet[1];
452 }
453 static inline uint8_t sm_pairing_packet_get_oob_data_flag(sm_pairing_packet_t packet){
454     return packet[2];
455 }
456 static inline uint8_t sm_pairing_packet_get_auth_req(sm_pairing_packet_t packet){
457     return packet[3];
458 }
459 static inline uint8_t sm_pairing_packet_get_max_encryption_key_size(sm_pairing_packet_t packet){
460     return packet[4];
461 }
462 static inline uint8_t sm_pairing_packet_get_initiator_key_distribution(sm_pairing_packet_t packet){
463     return packet[5];
464 }
465 static inline uint8_t sm_pairing_packet_get_responder_key_distribution(sm_pairing_packet_t packet){
466     return packet[6];
467 }
468 
469 static inline void sm_pairing_packet_set_code(sm_pairing_packet_t packet, uint8_t code){
470     packet[0] = code;
471 }
472 static inline void sm_pairing_packet_set_io_capability(sm_pairing_packet_t packet, uint8_t io_capability){
473     packet[1] = io_capability;
474 }
475 static inline void sm_pairing_packet_set_oob_data_flag(sm_pairing_packet_t packet, uint8_t oob_data_flag){
476     packet[2] = oob_data_flag;
477 }
478 static inline void sm_pairing_packet_set_auth_req(sm_pairing_packet_t packet, uint8_t auth_req){
479     packet[3] = auth_req;
480 }
481 static inline void sm_pairing_packet_set_max_encryption_key_size(sm_pairing_packet_t packet, uint8_t max_encryption_key_size){
482     packet[4] = max_encryption_key_size;
483 }
484 static inline void sm_pairing_packet_set_initiator_key_distribution(sm_pairing_packet_t packet, uint8_t initiator_key_distribution){
485     packet[5] = initiator_key_distribution;
486 }
487 static inline void sm_pairing_packet_set_responder_key_distribution(sm_pairing_packet_t packet, uint8_t responder_key_distribution){
488     packet[6] = responder_key_distribution;
489 }
490 
491 // @returns 1 if all bytes are 0
492 static int sm_is_null(uint8_t * data, int size){
493     int i;
494     for (i=0; i < size ; i++){
495         if (data[i]) return 0;
496     }
497     return 1;
498 }
499 
500 static int sm_is_null_random(uint8_t random[8]){
501     return sm_is_null(random, 8);
502 }
503 
504 static int sm_is_null_key(uint8_t * key){
505     return sm_is_null(key, 16);
506 }
507 
508 // Key utils
509 static void sm_reset_tk(void){
510     int i;
511     for (i=0;i<16;i++){
512         setup->sm_tk[i] = 0;
513     }
514 }
515 
516 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
517 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
518 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
519     int i;
520     for (i = max_encryption_size ; i < 16 ; i++){
521         key[15-i] = 0;
522     }
523 }
524 
525 // SMP Timeout implementation
526 
527 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
528 // the Security Manager Timer shall be reset and started.
529 //
530 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
531 //
532 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
533 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
534 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
535 // established.
536 
537 static void sm_timeout_handler(btstack_timer_source_t * timer){
538     log_info("SM timeout");
539     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
540     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
541     sm_notify_client_status_reason(sm_conn, ERROR_CODE_CONNECTION_TIMEOUT, 0);
542     sm_done_for_handle(sm_conn->sm_handle);
543 
544     // trigger handling of next ready connection
545     sm_run();
546 }
547 static void sm_timeout_start(sm_connection_t * sm_conn){
548     btstack_run_loop_remove_timer(&setup->sm_timeout);
549     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
550     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
551     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
552     btstack_run_loop_add_timer(&setup->sm_timeout);
553 }
554 static void sm_timeout_stop(void){
555     btstack_run_loop_remove_timer(&setup->sm_timeout);
556 }
557 static void sm_timeout_reset(sm_connection_t * sm_conn){
558     sm_timeout_stop();
559     sm_timeout_start(sm_conn);
560 }
561 
562 // end of sm timeout
563 
564 // GAP Random Address updates
565 static gap_random_address_type_t gap_random_adress_type;
566 static btstack_timer_source_t gap_random_address_update_timer;
567 static uint32_t gap_random_adress_update_period;
568 
569 static void gap_random_address_trigger(void){
570     if (rau_state != RAU_IDLE) return;
571     log_info("gap_random_address_trigger");
572     rau_state = RAU_GET_RANDOM;
573     sm_run();
574 }
575 
576 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
577     UNUSED(timer);
578 
579     log_info("GAP Random Address Update due");
580     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
581     btstack_run_loop_add_timer(&gap_random_address_update_timer);
582     gap_random_address_trigger();
583 }
584 
585 static void gap_random_address_update_start(void){
586     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
587     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
588     btstack_run_loop_add_timer(&gap_random_address_update_timer);
589 }
590 
591 static void gap_random_address_update_stop(void){
592     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
593 }
594 
595 
596 static void sm_random_start(void * context){
597     sm_random_context = context;
598     hci_send_cmd(&hci_le_rand);
599 }
600 
601 #ifdef HAVE_AES128
602 static void aes128_completed(btstack_timer_source_t * ts){
603     UNUSED(ts);
604     sm_handle_encryption_result(&aes128_result_flipped[0]);
605     sm_run();
606 }
607 #endif
608 
609 // pre: sm_aes128_state != SM_AES128_ACTIVE, hci_can_send_command == 1
610 // context is made availabe to aes128 result handler by this
611 static void sm_aes128_start(sm_key_t key, sm_key_t plaintext, void * context){
612     sm_aes128_state = SM_AES128_ACTIVE;
613     sm_aes128_context = context;
614 
615 #ifdef HAVE_AES128
616     // calc result directly
617     sm_key_t result;
618     btstack_aes128_calc(key, plaintext, result);
619 
620     // log
621     log_info_key("key", key);
622     log_info_key("txt", plaintext);
623     log_info_key("res", result);
624 
625     // flip
626     reverse_128(&result[0], &aes128_result_flipped[0]);
627 
628     // deliver via timer
629     btstack_run_loop_set_timer_handler(&aes128_timer, &aes128_completed);
630     btstack_run_loop_set_timer(&aes128_timer, 0);    // no delay
631     btstack_run_loop_add_timer(&aes128_timer);
632 #else
633     sm_key_t key_flipped, plaintext_flipped;
634     reverse_128(key, key_flipped);
635     reverse_128(plaintext, plaintext_flipped);
636     hci_send_cmd(&hci_le_encrypt, key_flipped, plaintext_flipped);
637 #endif
638 }
639 
640 // ah(k,r) helper
641 // r = padding || r
642 // r - 24 bit value
643 static void sm_ah_r_prime(uint8_t r[3], uint8_t * r_prime){
644     // r'= padding || r
645     memset(r_prime, 0, 16);
646     memcpy(&r_prime[13], r, 3);
647 }
648 
649 // d1 helper
650 // d' = padding || r || d
651 // d,r - 16 bit values
652 static void sm_d1_d_prime(uint16_t d, uint16_t r, uint8_t * d1_prime){
653     // d'= padding || r || d
654     memset(d1_prime, 0, 16);
655     big_endian_store_16(d1_prime, 12, r);
656     big_endian_store_16(d1_prime, 14, d);
657 }
658 
659 // dm helper
660 // r’ = padding || r
661 // r - 64 bit value
662 static void sm_dm_r_prime(uint8_t r[8], uint8_t * r_prime){
663     memset(r_prime, 0, 16);
664     memcpy(&r_prime[8], r, 8);
665 }
666 
667 // calculate arguments for first AES128 operation in C1 function
668 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, uint8_t * t1){
669 
670     // p1 = pres || preq || rat’ || iat’
671     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
672     // cant octet of pres becomes the most significant octet of p1.
673     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
674     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
675     // p1 is 0x05000800000302070710000001010001."
676 
677     sm_key_t p1;
678     reverse_56(pres, &p1[0]);
679     reverse_56(preq, &p1[7]);
680     p1[14] = rat;
681     p1[15] = iat;
682     log_info_key("p1", p1);
683     log_info_key("r", r);
684 
685     // t1 = r xor p1
686     int i;
687     for (i=0;i<16;i++){
688         t1[i] = r[i] ^ p1[i];
689     }
690     log_info_key("t1", t1);
691 }
692 
693 // calculate arguments for second AES128 operation in C1 function
694 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, uint8_t * t3){
695      // p2 = padding || ia || ra
696     // "The least significant octet of ra becomes the least significant octet of p2 and
697     // the most significant octet of padding becomes the most significant octet of p2.
698     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
699     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
700 
701     sm_key_t p2;
702     memset(p2, 0, 16);
703     memcpy(&p2[4],  ia, 6);
704     memcpy(&p2[10], ra, 6);
705     log_info_key("p2", p2);
706 
707     // c1 = e(k, t2_xor_p2)
708     int i;
709     for (i=0;i<16;i++){
710         t3[i] = t2[i] ^ p2[i];
711     }
712     log_info_key("t3", t3);
713 }
714 
715 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, uint8_t * r_prime){
716     log_info_key("r1", r1);
717     log_info_key("r2", r2);
718     memcpy(&r_prime[8], &r2[8], 8);
719     memcpy(&r_prime[0], &r1[8], 8);
720 }
721 
722 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
723     UNUSED(channel);
724 
725     // log event
726     hci_dump_packet(packet_type, 1, packet, size);
727     // dispatch to all event handlers
728     btstack_linked_list_iterator_t it;
729     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
730     while (btstack_linked_list_iterator_has_next(&it)){
731         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
732         entry->callback(packet_type, 0, packet, size);
733     }
734 }
735 
736 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
737     event[0] = type;
738     event[1] = event_size - 2;
739     little_endian_store_16(event, 2, con_handle);
740     event[4] = addr_type;
741     reverse_bd_addr(address, &event[5]);
742 }
743 
744 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
745     uint8_t event[11];
746     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
747     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
748 }
749 
750 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
751     uint8_t event[15];
752     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
753     little_endian_store_32(event, 11, passkey);
754     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
755 }
756 
757 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
758     // fetch addr and addr type from db
759     bd_addr_t identity_address;
760     int identity_address_type;
761     le_device_db_info(index, &identity_address_type, identity_address, NULL);
762 
763     uint8_t event[19];
764     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
765     event[11] = identity_address_type;
766     reverse_bd_addr(identity_address, &event[12]);
767     event[18] = index;
768     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
769 }
770 
771 static void sm_notify_client_status(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t status){
772     uint8_t event[12];
773     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
774     event[11] = status;
775     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
776 }
777 
778 static void sm_notify_client_status_reason(sm_connection_t * sm_conn, uint8_t status, uint8_t reason){
779     uint8_t event[13];
780     sm_setup_event_base(event, sizeof(event), SM_EVENT_PAIRING_COMPLETE, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address);
781     event[11] = status;
782     event[12] = reason;
783     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
784 }
785 
786 // decide on stk generation based on
787 // - pairing request
788 // - io capabilities
789 // - OOB data availability
790 static void sm_setup_tk(void){
791 
792     // default: just works
793     setup->sm_stk_generation_method = JUST_WORKS;
794 
795 #ifdef ENABLE_LE_SECURE_CONNECTIONS
796     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
797                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
798                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
799 #else
800     setup->sm_use_secure_connections = 0;
801 #endif
802     log_info("Secure pairing: %u", setup->sm_use_secure_connections);
803 
804 
805     // decide if OOB will be used based on SC vs. Legacy and oob flags
806     int use_oob = 0;
807     if (setup->sm_use_secure_connections){
808         // In LE Secure Connections pairing, the out of band method is used if at least
809         // one device has the peer device's out of band authentication data available.
810         use_oob = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) | sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
811     } else {
812         // In LE legacy pairing, the out of band method is used if both the devices have
813         // the other device's out of band authentication data available.
814         use_oob = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) & sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
815     }
816     if (use_oob){
817         log_info("SM: have OOB data");
818         log_info_key("OOB", setup->sm_tk);
819         setup->sm_stk_generation_method = OOB;
820         return;
821     }
822 
823     // If both devices have not set the MITM option in the Authentication Requirements
824     // Flags, then the IO capabilities shall be ignored and the Just Works association
825     // model shall be used.
826     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
827     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
828         log_info("SM: MITM not required by both -> JUST WORKS");
829         return;
830     }
831 
832     // Reset TK as it has been setup in sm_init_setup
833     sm_reset_tk();
834 
835     // Also use just works if unknown io capabilites
836     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
837         return;
838     }
839 
840     // Otherwise the IO capabilities of the devices shall be used to determine the
841     // pairing method as defined in Table 2.4.
842     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
843     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
844 
845 #ifdef ENABLE_LE_SECURE_CONNECTIONS
846     // table not define by default
847     if (setup->sm_use_secure_connections){
848         generation_method = stk_generation_method_with_secure_connection;
849     }
850 #endif
851     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
852 
853     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
854         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
855 }
856 
857 static int sm_key_distribution_flags_for_set(uint8_t key_set){
858     int flags = 0;
859     if (key_set & SM_KEYDIST_ENC_KEY){
860         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
861         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
862     }
863     if (key_set & SM_KEYDIST_ID_KEY){
864         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
865         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
866     }
867     if (key_set & SM_KEYDIST_SIGN){
868         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
869     }
870     return flags;
871 }
872 
873 static void sm_setup_key_distribution(uint8_t key_set){
874     setup->sm_key_distribution_received_set = 0;
875     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
876 }
877 
878 // CSRK Key Lookup
879 
880 
881 static int sm_address_resolution_idle(void){
882     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
883 }
884 
885 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
886     memcpy(sm_address_resolution_address, addr, 6);
887     sm_address_resolution_addr_type = addr_type;
888     sm_address_resolution_test = 0;
889     sm_address_resolution_mode = mode;
890     sm_address_resolution_context = context;
891     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
892 }
893 
894 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
895     // check if already in list
896     btstack_linked_list_iterator_t it;
897     sm_lookup_entry_t * entry;
898     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
899     while(btstack_linked_list_iterator_has_next(&it)){
900         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
901         if (entry->address_type != address_type) continue;
902         if (memcmp(entry->address, address, 6))  continue;
903         // already in list
904         return BTSTACK_BUSY;
905     }
906     entry = btstack_memory_sm_lookup_entry_get();
907     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
908     entry->address_type = (bd_addr_type_t) address_type;
909     memcpy(entry->address, address, 6);
910     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
911     sm_run();
912     return 0;
913 }
914 
915 // while x_state++ for an enum is possible in C, it isn't in C++. we use this helpers to avoid compile errors for now
916 static inline void sm_next_responding_state(sm_connection_t * sm_conn){
917     sm_conn->sm_engine_state = (security_manager_state_t) (((int)sm_conn->sm_engine_state) + 1);
918 }
919 static inline void dkg_next_state(void){
920     dkg_state = (derived_key_generation_t) (((int)dkg_state) + 1);
921 }
922 static inline void rau_next_state(void){
923     rau_state = (random_address_update_t) (((int)rau_state) + 1);
924 }
925 
926 // CMAC calculation using AES Engine
927 #ifdef ENABLE_CMAC_ENGINE
928 
929 static inline void sm_cmac_next_state(void){
930     sm_cmac_state = (cmac_state_t) (((int)sm_cmac_state) + 1);
931 }
932 
933 static int sm_cmac_last_block_complete(void){
934     if (sm_cmac_message_len == 0) return 0;
935     return (sm_cmac_message_len & 0x0f) == 0;
936 }
937 
938 int sm_cmac_ready(void){
939     return sm_cmac_state == CMAC_IDLE;
940 }
941 
942 // generic cmac calculation
943 void sm_cmac_general_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t hash[8])){
944     // Generalized CMAC
945     memcpy(sm_cmac_k, key, 16);
946     memset(sm_cmac_x, 0, 16);
947     sm_cmac_block_current = 0;
948     sm_cmac_message_len  = message_len;
949     sm_cmac_done_handler = done_callback;
950     sm_cmac_get_byte     = get_byte_callback;
951 
952     // step 2: n := ceil(len/const_Bsize);
953     sm_cmac_block_count = (sm_cmac_message_len + 15) / 16;
954 
955     // step 3: ..
956     if (sm_cmac_block_count==0){
957         sm_cmac_block_count = 1;
958     }
959     log_info("sm_cmac_general_start: len %u, block count %u", sm_cmac_message_len, sm_cmac_block_count);
960 
961     // first, we need to compute l for k1, k2, and m_last
962     sm_cmac_state = CMAC_CALC_SUBKEYS;
963 
964     // let's go
965     sm_run();
966 }
967 #endif
968 
969 // cmac for ATT Message signing
970 #ifdef ENABLE_LE_SIGNED_WRITE
971 static uint8_t sm_cmac_signed_write_message_get_byte(uint16_t offset){
972     if (offset >= sm_cmac_message_len) {
973         log_error("sm_cmac_signed_write_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_message_len);
974         return 0;
975     }
976 
977     offset = sm_cmac_message_len - 1 - offset;
978 
979     // sm_cmac_header[3] | message[] | sm_cmac_sign_counter[4]
980     if (offset < 3){
981         return sm_cmac_header[offset];
982     }
983     int actual_message_len_incl_header = sm_cmac_message_len - 4;
984     if (offset <  actual_message_len_incl_header){
985         return sm_cmac_message[offset - 3];
986     }
987     return sm_cmac_sign_counter[offset - actual_message_len_incl_header];
988 }
989 
990 void sm_cmac_signed_write_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
991     // ATT Message Signing
992     sm_cmac_header[0] = opcode;
993     little_endian_store_16(sm_cmac_header, 1, con_handle);
994     little_endian_store_32(sm_cmac_sign_counter, 0, sign_counter);
995     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
996     sm_cmac_message = message;
997     sm_cmac_general_start(k, total_message_len, &sm_cmac_signed_write_message_get_byte, done_handler);
998 }
999 #endif
1000 
1001 #ifdef ENABLE_CMAC_ENGINE
1002 static void sm_cmac_handle_aes_engine_ready(void){
1003     switch (sm_cmac_state){
1004         case CMAC_CALC_SUBKEYS: {
1005             sm_key_t const_zero;
1006             memset(const_zero, 0, 16);
1007             sm_cmac_next_state();
1008             sm_aes128_start(sm_cmac_k, const_zero, NULL);
1009             break;
1010         }
1011         case CMAC_CALC_MI: {
1012             int j;
1013             sm_key_t y;
1014             for (j=0;j<16;j++){
1015                 y[j] = sm_cmac_x[j] ^ sm_cmac_get_byte(sm_cmac_block_current*16 + j);
1016             }
1017             sm_cmac_block_current++;
1018             sm_cmac_next_state();
1019             sm_aes128_start(sm_cmac_k, y, NULL);
1020             break;
1021         }
1022         case CMAC_CALC_MLAST: {
1023             int i;
1024             sm_key_t y;
1025             for (i=0;i<16;i++){
1026                 y[i] = sm_cmac_x[i] ^ sm_cmac_m_last[i];
1027             }
1028             log_info_key("Y", y);
1029             sm_cmac_block_current++;
1030             sm_cmac_next_state();
1031             sm_aes128_start(sm_cmac_k, y, NULL);
1032             break;
1033         }
1034         default:
1035             log_info("sm_cmac_handle_aes_engine_ready called in state %u", sm_cmac_state);
1036             break;
1037     }
1038 }
1039 
1040 // CMAC Implementation using AES128 engine
1041 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data){
1042     int i;
1043     int carry = 0;
1044     for (i=len-1; i >= 0 ; i--){
1045         int new_carry = data[i] >> 7;
1046         data[i] = data[i] << 1 | carry;
1047         carry = new_carry;
1048     }
1049 }
1050 
1051 static void sm_cmac_handle_encryption_result(sm_key_t data){
1052     switch (sm_cmac_state){
1053         case CMAC_W4_SUBKEYS: {
1054             sm_key_t k1;
1055             memcpy(k1, data, 16);
1056             sm_shift_left_by_one_bit_inplace(16, k1);
1057             if (data[0] & 0x80){
1058                 k1[15] ^= 0x87;
1059             }
1060             sm_key_t k2;
1061             memcpy(k2, k1, 16);
1062             sm_shift_left_by_one_bit_inplace(16, k2);
1063             if (k1[0] & 0x80){
1064                 k2[15] ^= 0x87;
1065             }
1066 
1067             log_info_key("k", sm_cmac_k);
1068             log_info_key("k1", k1);
1069             log_info_key("k2", k2);
1070 
1071             // step 4: set m_last
1072             int i;
1073             if (sm_cmac_last_block_complete()){
1074                 for (i=0;i<16;i++){
1075                     sm_cmac_m_last[i] = sm_cmac_get_byte(sm_cmac_message_len - 16 + i) ^ k1[i];
1076                 }
1077             } else {
1078                 int valid_octets_in_last_block = sm_cmac_message_len & 0x0f;
1079                 for (i=0;i<16;i++){
1080                     if (i < valid_octets_in_last_block){
1081                         sm_cmac_m_last[i] = sm_cmac_get_byte((sm_cmac_message_len & 0xfff0) + i) ^ k2[i];
1082                         continue;
1083                     }
1084                     if (i == valid_octets_in_last_block){
1085                         sm_cmac_m_last[i] = 0x80 ^ k2[i];
1086                         continue;
1087                     }
1088                     sm_cmac_m_last[i] = k2[i];
1089                 }
1090             }
1091 
1092             // next
1093             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1094             break;
1095         }
1096         case CMAC_W4_MI:
1097             memcpy(sm_cmac_x, data, 16);
1098             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1099             break;
1100         case CMAC_W4_MLAST:
1101             // done
1102             log_info("Setting CMAC Engine to IDLE");
1103             sm_cmac_state = CMAC_IDLE;
1104             log_info_key("CMAC", data);
1105             sm_cmac_done_handler(data);
1106             break;
1107         default:
1108             log_info("sm_cmac_handle_encryption_result called in state %u", sm_cmac_state);
1109             break;
1110     }
1111 }
1112 #endif
1113 
1114 static void sm_trigger_user_response(sm_connection_t * sm_conn){
1115     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
1116     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
1117     switch (setup->sm_stk_generation_method){
1118         case PK_RESP_INPUT:
1119             if (IS_RESPONDER(sm_conn->sm_role)){
1120                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1121                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1122             } else {
1123                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1124             }
1125             break;
1126         case PK_INIT_INPUT:
1127             if (IS_RESPONDER(sm_conn->sm_role)){
1128                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1129             } else {
1130                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1131                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1132             }
1133             break;
1134         case OK_BOTH_INPUT:
1135             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1136             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1137             break;
1138         case NK_BOTH_INPUT:
1139             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1140             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1141             break;
1142         case JUST_WORKS:
1143             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1144             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1145             break;
1146         case OOB:
1147             // client already provided OOB data, let's skip notification.
1148             break;
1149     }
1150 }
1151 
1152 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
1153     int recv_flags;
1154     if (IS_RESPONDER(sm_conn->sm_role)){
1155         // slave / responder
1156         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
1157     } else {
1158         // master / initiator
1159         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
1160     }
1161     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
1162     return recv_flags == setup->sm_key_distribution_received_set;
1163 }
1164 
1165 static void sm_done_for_handle(hci_con_handle_t con_handle){
1166     if (sm_active_connection_handle == con_handle){
1167         sm_timeout_stop();
1168         sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
1169         log_info("sm: connection 0x%x released setup context", con_handle);
1170     }
1171 }
1172 
1173 static int sm_key_distribution_flags_for_auth_req(void){
1174 
1175     int flags = SM_KEYDIST_ID_KEY;
1176     if (sm_auth_req & SM_AUTHREQ_BONDING){
1177         // encryption and signing information only if bonding requested
1178         flags |= SM_KEYDIST_ENC_KEY;
1179 #ifdef ENABLE_LE_SIGNED_WRITE
1180         flags |= SM_KEYDIST_SIGN;
1181 #endif
1182     }
1183     return flags;
1184 }
1185 
1186 static void sm_reset_setup(void){
1187     // fill in sm setup
1188     setup->sm_state_vars = 0;
1189     setup->sm_keypress_notification = 0;
1190     sm_reset_tk();
1191 }
1192 
1193 static void sm_init_setup(sm_connection_t * sm_conn){
1194 
1195     // fill in sm setup
1196     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1197     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1198 
1199     // query client for Legacy Pairing OOB data
1200     setup->sm_have_oob_data = 0;
1201     if (sm_get_oob_data) {
1202         setup->sm_have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1203     }
1204 
1205     // if available and SC supported, also ask for SC OOB Data
1206 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1207     memset(setup->sm_ra, 0, 16);
1208     memset(setup->sm_rb, 0, 16);
1209     if (setup->sm_have_oob_data && (sm_auth_req & SM_AUTHREQ_SECURE_CONNECTION)){
1210         if (sm_get_sc_oob_data){
1211             if (IS_RESPONDER(sm_conn->sm_role)){
1212                 setup->sm_have_oob_data = (*sm_get_sc_oob_data)(
1213                     sm_conn->sm_peer_addr_type,
1214                     sm_conn->sm_peer_address,
1215                     setup->sm_peer_confirm,
1216                     setup->sm_ra);
1217             } else {
1218                 setup->sm_have_oob_data = (*sm_get_sc_oob_data)(
1219                     sm_conn->sm_peer_addr_type,
1220                     sm_conn->sm_peer_address,
1221                     setup->sm_peer_confirm,
1222                     setup->sm_rb);
1223             }
1224         } else {
1225             setup->sm_have_oob_data = 0;
1226         }
1227     }
1228 #endif
1229 
1230     sm_pairing_packet_t * local_packet;
1231     if (IS_RESPONDER(sm_conn->sm_role)){
1232         // slave
1233         local_packet = &setup->sm_s_pres;
1234         gap_le_get_own_address(&setup->sm_s_addr_type, setup->sm_s_address);
1235         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1236         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1237     } else {
1238         // master
1239         local_packet = &setup->sm_m_preq;
1240         gap_le_get_own_address(&setup->sm_m_addr_type, setup->sm_m_address);
1241         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1242         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1243 
1244         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1245         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1246         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1247     }
1248 
1249     uint8_t auth_req = sm_auth_req;
1250     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1251     sm_pairing_packet_set_oob_data_flag(*local_packet, setup->sm_have_oob_data);
1252     sm_pairing_packet_set_auth_req(*local_packet, auth_req);
1253     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1254 }
1255 
1256 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1257 
1258     sm_pairing_packet_t * remote_packet;
1259     int                   remote_key_request;
1260     if (IS_RESPONDER(sm_conn->sm_role)){
1261         // slave / responder
1262         remote_packet      = &setup->sm_m_preq;
1263         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1264     } else {
1265         // master / initiator
1266         remote_packet      = &setup->sm_s_pres;
1267         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1268     }
1269 
1270     // check key size
1271     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1272     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1273 
1274     // decide on STK generation method
1275     sm_setup_tk();
1276     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1277 
1278     // check if STK generation method is acceptable by client
1279     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1280 
1281     // identical to responder
1282     sm_setup_key_distribution(remote_key_request);
1283 
1284     // JUST WORKS doens't provide authentication
1285     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1286 
1287     return 0;
1288 }
1289 
1290 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1291 
1292     // cache and reset context
1293     int matched_device_id = sm_address_resolution_test;
1294     address_resolution_mode_t mode = sm_address_resolution_mode;
1295     void * context = sm_address_resolution_context;
1296 
1297     // reset context
1298     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1299     sm_address_resolution_context = NULL;
1300     sm_address_resolution_test = -1;
1301     hci_con_handle_t con_handle = 0;
1302 
1303     sm_connection_t * sm_connection;
1304 #ifdef ENABLE_LE_CENTRAL
1305     sm_key_t ltk;
1306 #endif
1307     switch (mode){
1308         case ADDRESS_RESOLUTION_GENERAL:
1309             break;
1310         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1311             sm_connection = (sm_connection_t *) context;
1312             con_handle = sm_connection->sm_handle;
1313             switch (event){
1314                 case ADDRESS_RESOLUTION_SUCEEDED:
1315                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1316                     sm_connection->sm_le_db_index = matched_device_id;
1317                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1318                     if (sm_connection->sm_role) {
1319                         // LTK request received before, IRK required -> start LTK calculation
1320                         if (sm_connection->sm_engine_state == SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK){
1321                             sm_connection->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
1322                         }
1323                         break;
1324                     }
1325 #ifdef ENABLE_LE_CENTRAL
1326                     if (!sm_connection->sm_pairing_requested && !sm_connection->sm_security_request_received) break;
1327                     sm_connection->sm_security_request_received = 0;
1328                     sm_connection->sm_pairing_requested = 0;
1329                     le_device_db_encryption_get(sm_connection->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
1330                     if (!sm_is_null_key(ltk)){
1331                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1332                     } else {
1333                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1334                     }
1335 #endif
1336                     break;
1337                 case ADDRESS_RESOLUTION_FAILED:
1338                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1339                     if (sm_connection->sm_role) {
1340                         // LTK request received before, IRK required -> negative LTK reply
1341                         if (sm_connection->sm_engine_state == SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK){
1342                             sm_connection->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
1343                         }
1344                         break;
1345                     }
1346 #ifdef ENABLE_LE_CENTRAL
1347                     if (!sm_connection->sm_pairing_requested && !sm_connection->sm_security_request_received) break;
1348                     sm_connection->sm_security_request_received = 0;
1349                     sm_connection->sm_pairing_requested = 0;
1350                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1351 #endif
1352                     break;
1353             }
1354             break;
1355         default:
1356             break;
1357     }
1358 
1359     switch (event){
1360         case ADDRESS_RESOLUTION_SUCEEDED:
1361             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1362             break;
1363         case ADDRESS_RESOLUTION_FAILED:
1364             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1365             break;
1366     }
1367 }
1368 
1369 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1370 
1371     int le_db_index = -1;
1372 
1373     // only store pairing information if both sides are bondable, i.e., the bonadble flag is set
1374     int bonding_enabed = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
1375                          & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
1376                          & SM_AUTHREQ_BONDING ) != 0;
1377 
1378     if (bonding_enabed){
1379 
1380         // lookup device based on IRK
1381         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1382             int i;
1383             for (i=0; i < le_device_db_max_count(); i++){
1384                 sm_key_t irk;
1385                 bd_addr_t address;
1386                 int address_type;
1387                 le_device_db_info(i, &address_type, address, irk);
1388                 if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
1389                     log_info("sm: device found for IRK, updating");
1390                     le_db_index = i;
1391                     break;
1392                 }
1393             }
1394         }
1395 
1396         // if not found, lookup via public address if possible
1397         log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1398         if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1399             int i;
1400             for (i=0; i < le_device_db_max_count(); i++){
1401                 bd_addr_t address;
1402                 int address_type;
1403                 le_device_db_info(i, &address_type, address, NULL);
1404                 log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1405                 if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1406                     log_info("sm: device found for public address, updating");
1407                     le_db_index = i;
1408                     break;
1409                 }
1410             }
1411         }
1412 
1413         // if not found, add to db
1414         if (le_db_index < 0) {
1415             le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1416         }
1417 
1418         if (le_db_index >= 0){
1419 
1420             sm_notify_client_index(SM_EVENT_IDENTITY_CREATED, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address, le_db_index);
1421 
1422 #ifdef ENABLE_LE_SIGNED_WRITE
1423             // store local CSRK
1424             if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1425                 log_info("sm: store local CSRK");
1426                 le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1427                 le_device_db_local_counter_set(le_db_index, 0);
1428             }
1429 
1430             // store remote CSRK
1431             if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1432                 log_info("sm: store remote CSRK");
1433                 le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1434                 le_device_db_remote_counter_set(le_db_index, 0);
1435             }
1436 #endif
1437             // store encryption information for secure connections: LTK generated by ECDH
1438             if (setup->sm_use_secure_connections){
1439                 log_info("sm: store SC LTK (key size %u, authenticated %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1440                 uint8_t zero_rand[8];
1441                 memset(zero_rand, 0, 8);
1442                 le_device_db_encryption_set(le_db_index, 0, zero_rand, setup->sm_ltk, sm_conn->sm_actual_encryption_key_size,
1443                     sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1444             }
1445 
1446             // store encryption information for legacy pairing: peer LTK, EDIV, RAND
1447             else if ( (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION)
1448                    && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_MASTER_IDENTIFICATION )){
1449                 log_info("sm: set encryption information (key size %u, authenticated %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1450                 le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1451                     sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1452 
1453             }
1454         }
1455     } else {
1456         log_info("Ignoring received keys, bonding not enabled");
1457     }
1458 
1459     // keep le_db_index
1460     sm_conn->sm_le_db_index = le_db_index;
1461 }
1462 
1463 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1464     setup->sm_pairing_failed_reason = reason;
1465     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1466 }
1467 
1468 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1469     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1470 }
1471 
1472 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1473 
1474 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1475 static int sm_passkey_used(stk_generation_method_t method);
1476 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1477 
1478 static void sm_log_ec_keypair(void){
1479     log_info("Elliptic curve: X");
1480     log_info_hexdump(&ec_q[0],32);
1481     log_info("Elliptic curve: Y");
1482     log_info_hexdump(&ec_q[32],32);
1483 }
1484 
1485 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1486     if (sm_passkey_used(setup->sm_stk_generation_method)){
1487         sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1488     } else {
1489         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1490     }
1491 }
1492 
1493 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1494     if (IS_RESPONDER(sm_conn->sm_role)){
1495         // Responder
1496         if (setup->sm_stk_generation_method == OOB){
1497             // generate Nb
1498             log_info("Generate Nb");
1499             sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1500         } else {
1501             sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1502         }
1503     } else {
1504         // Initiator role
1505         switch (setup->sm_stk_generation_method){
1506             case JUST_WORKS:
1507                 sm_sc_prepare_dhkey_check(sm_conn);
1508                 break;
1509 
1510             case NK_BOTH_INPUT:
1511                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1512                 break;
1513             case PK_INIT_INPUT:
1514             case PK_RESP_INPUT:
1515             case OK_BOTH_INPUT:
1516                 if (setup->sm_passkey_bit < 20) {
1517                     sm_sc_start_calculating_local_confirm(sm_conn);
1518                 } else {
1519                     sm_sc_prepare_dhkey_check(sm_conn);
1520                 }
1521                 break;
1522             case OOB:
1523                 sm_sc_prepare_dhkey_check(sm_conn);
1524                 break;
1525         }
1526     }
1527 }
1528 
1529 static uint8_t sm_sc_cmac_get_byte(uint16_t offset){
1530     return sm_cmac_sc_buffer[offset];
1531 }
1532 
1533 static void sm_sc_cmac_done(uint8_t * hash){
1534     log_info("sm_sc_cmac_done: ");
1535     log_info_hexdump(hash, 16);
1536 
1537     if (sm_sc_oob_state == SM_SC_OOB_W4_CONFIRM){
1538         sm_sc_oob_state = SM_SC_OOB_IDLE;
1539         (*sm_sc_oob_callback)(hash, sm_sc_oob_random);
1540         return;
1541     }
1542 
1543     sm_connection_t * sm_conn = sm_cmac_connection;
1544     sm_cmac_connection = NULL;
1545 #ifdef ENABLE_CLASSIC
1546     link_key_type_t link_key_type;
1547 #endif
1548 
1549     switch (sm_conn->sm_engine_state){
1550         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1551             memcpy(setup->sm_local_confirm, hash, 16);
1552             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1553             break;
1554         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1555             // check
1556             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1557                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1558                 break;
1559             }
1560             sm_sc_state_after_receiving_random(sm_conn);
1561             break;
1562         case SM_SC_W4_CALCULATE_G2: {
1563             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1564             big_endian_store_32(setup->sm_tk, 12, vab);
1565             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1566             sm_trigger_user_response(sm_conn);
1567             break;
1568         }
1569         case SM_SC_W4_CALCULATE_F5_SALT:
1570             memcpy(setup->sm_t, hash, 16);
1571             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1572             break;
1573         case SM_SC_W4_CALCULATE_F5_MACKEY:
1574             memcpy(setup->sm_mackey, hash, 16);
1575             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1576             break;
1577         case SM_SC_W4_CALCULATE_F5_LTK:
1578             // truncate sm_ltk, but keep full LTK for cross-transport key derivation in sm_local_ltk
1579             // Errata Service Release to the Bluetooth Specification: ESR09
1580             //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1581             //   Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1582             memcpy(setup->sm_ltk, hash, 16);
1583             memcpy(setup->sm_local_ltk, hash, 16);
1584             sm_truncate_key(setup->sm_ltk, sm_conn->sm_actual_encryption_key_size);
1585             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1586             break;
1587         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1588             memcpy(setup->sm_local_dhkey_check, hash, 16);
1589             if (IS_RESPONDER(sm_conn->sm_role)){
1590                 // responder
1591                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1592                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1593                 } else {
1594                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1595                 }
1596             } else {
1597                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1598             }
1599             break;
1600         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1601             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1602                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1603                 break;
1604             }
1605             if (IS_RESPONDER(sm_conn->sm_role)){
1606                 // responder
1607                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1608             } else {
1609                 // initiator
1610                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1611             }
1612             break;
1613         case SM_SC_W4_CALCULATE_H6_ILK:
1614             memcpy(setup->sm_t, hash, 16);
1615             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY;
1616             break;
1617         case SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY:
1618 #ifdef ENABLE_CLASSIC
1619             reverse_128(hash, setup->sm_t);
1620             link_key_type = sm_conn->sm_connection_authenticated ?
1621                 AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256 : UNAUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256;
1622             log_info("Derived classic link key from LE using h6, type %u", (int) link_key_type);
1623             if (IS_RESPONDER(sm_conn->sm_role)){
1624                 gap_store_link_key_for_bd_addr(setup->sm_m_address, setup->sm_t, link_key_type);
1625             } else {
1626                 gap_store_link_key_for_bd_addr(setup->sm_s_address, setup->sm_t, link_key_type);
1627             }
1628 #endif
1629             if (IS_RESPONDER(sm_conn->sm_role)){
1630                 sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
1631             } else {
1632                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
1633             }
1634             sm_notify_client_status_reason(sm_conn, ERROR_CODE_SUCCESS, 0);
1635             sm_done_for_handle(sm_conn->sm_handle);
1636             break;
1637         default:
1638             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1639             break;
1640     }
1641     sm_run();
1642 }
1643 
1644 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1645     const uint16_t message_len = 65;
1646     sm_cmac_connection = sm_conn;
1647     memcpy(sm_cmac_sc_buffer, u, 32);
1648     memcpy(sm_cmac_sc_buffer+32, v, 32);
1649     sm_cmac_sc_buffer[64] = z;
1650     log_info("f4 key");
1651     log_info_hexdump(x, 16);
1652     log_info("f4 message");
1653     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1654     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1655 }
1656 
1657 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1658 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1659 static const uint8_t f5_length[] = { 0x01, 0x00};
1660 
1661 #ifdef USE_SOFTWARE_ECDH_IMPLEMENTATION
1662 
1663 static void sm_sc_calculate_dhkey(sm_key256_t dhkey){
1664     memset(dhkey, 0, 32);
1665 
1666 #ifdef USE_MICRO_ECC_FOR_ECDH
1667 #if uECC_SUPPORTS_secp256r1
1668     // standard version
1669     uECC_shared_secret(setup->sm_peer_q, ec_d, dhkey, uECC_secp256r1());
1670 #else
1671     // static version
1672     uECC_shared_secret(setup->sm_peer_q, ec_d, dhkey);
1673 #endif
1674 #endif
1675 
1676 #ifdef USE_MBEDTLS_FOR_ECDH
1677     // da * Pb
1678     mbedtls_mpi d;
1679     mbedtls_ecp_point Q;
1680     mbedtls_ecp_point DH;
1681     mbedtls_mpi_init(&d);
1682     mbedtls_ecp_point_init(&Q);
1683     mbedtls_ecp_point_init(&DH);
1684     mbedtls_mpi_read_binary(&d, ec_d, 32);
1685     mbedtls_mpi_read_binary(&Q.X, &setup->sm_peer_q[0] , 32);
1686     mbedtls_mpi_read_binary(&Q.Y, &setup->sm_peer_q[32], 32);
1687     mbedtls_mpi_lset(&Q.Z, 1);
1688     mbedtls_ecp_mul(&mbedtls_ec_group, &DH, &d, &Q, NULL, NULL);
1689     mbedtls_mpi_write_binary(&DH.X, dhkey, 32);
1690     mbedtls_ecp_point_free(&DH);
1691     mbedtls_mpi_free(&d);
1692     mbedtls_ecp_point_free(&Q);
1693 #endif
1694 
1695     log_info("dhkey");
1696     log_info_hexdump(dhkey, 32);
1697 }
1698 #endif
1699 
1700 static void f5_calculate_salt(sm_connection_t * sm_conn){
1701     log_info("f5_calculate_salt");
1702     // calculate salt for f5
1703     const uint16_t message_len = 32;
1704     sm_cmac_connection = sm_conn;
1705     memcpy(sm_cmac_sc_buffer, setup->sm_dhkey, message_len);
1706     sm_cmac_general_start(f5_salt, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1707 }
1708 
1709 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1710     const uint16_t message_len = 53;
1711     sm_cmac_connection = sm_conn;
1712 
1713     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1714     sm_cmac_sc_buffer[0] = 0;
1715     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1716     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1717     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1718     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1719     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1720     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1721     log_info("f5 key");
1722     log_info_hexdump(t, 16);
1723     log_info("f5 message for MacKey");
1724     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1725     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1726 }
1727 
1728 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1729     sm_key56_t bd_addr_master, bd_addr_slave;
1730     bd_addr_master[0] =  setup->sm_m_addr_type;
1731     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1732     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1733     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1734     if (IS_RESPONDER(sm_conn->sm_role)){
1735         // responder
1736         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1737     } else {
1738         // initiator
1739         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1740     }
1741 }
1742 
1743 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1744 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1745     const uint16_t message_len = 53;
1746     sm_cmac_connection = sm_conn;
1747     sm_cmac_sc_buffer[0] = 1;
1748     // 1..52 setup before
1749     log_info("f5 key");
1750     log_info_hexdump(t, 16);
1751     log_info("f5 message for LTK");
1752     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1753     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1754 }
1755 
1756 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1757     f5_ltk(sm_conn, setup->sm_t);
1758 }
1759 
1760 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1761     const uint16_t message_len = 65;
1762     sm_cmac_connection = sm_conn;
1763     memcpy(sm_cmac_sc_buffer, n1, 16);
1764     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1765     memcpy(sm_cmac_sc_buffer+32, r, 16);
1766     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1767     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1768     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1769     log_info("f6 key");
1770     log_info_hexdump(w, 16);
1771     log_info("f6 message");
1772     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1773     sm_cmac_general_start(w, 65, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1774 }
1775 
1776 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1777 // - U is 256 bits
1778 // - V is 256 bits
1779 // - X is 128 bits
1780 // - Y is 128 bits
1781 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1782     const uint16_t message_len = 80;
1783     sm_cmac_connection = sm_conn;
1784     memcpy(sm_cmac_sc_buffer, u, 32);
1785     memcpy(sm_cmac_sc_buffer+32, v, 32);
1786     memcpy(sm_cmac_sc_buffer+64, y, 16);
1787     log_info("g2 key");
1788     log_info_hexdump(x, 16);
1789     log_info("g2 message");
1790     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1791     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1792 }
1793 
1794 static void g2_calculate(sm_connection_t * sm_conn) {
1795     // calc Va if numeric comparison
1796     if (IS_RESPONDER(sm_conn->sm_role)){
1797         // responder
1798         g2_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, setup->sm_local_nonce);;
1799     } else {
1800         // initiator
1801         g2_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, setup->sm_peer_nonce);
1802     }
1803 }
1804 
1805 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1806     uint8_t z = 0;
1807     if (sm_passkey_entry(setup->sm_stk_generation_method)){
1808         // some form of passkey
1809         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1810         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1811         setup->sm_passkey_bit++;
1812     }
1813     f4_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, z);
1814 }
1815 
1816 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1817     // OOB
1818     if (setup->sm_stk_generation_method == OOB){
1819         if (IS_RESPONDER(sm_conn->sm_role)){
1820             f4_engine(sm_conn, setup->sm_peer_q, setup->sm_peer_q, setup->sm_ra, 0);
1821         } else {
1822             f4_engine(sm_conn, setup->sm_peer_q, setup->sm_peer_q, setup->sm_rb, 0);
1823         }
1824         return;
1825     }
1826 
1827     uint8_t z = 0;
1828     if (sm_passkey_entry(setup->sm_stk_generation_method)){
1829         // some form of passkey
1830         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1831         // sm_passkey_bit was increased before sending confirm value
1832         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1833     }
1834     f4_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, z);
1835 }
1836 
1837 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1838 
1839 #ifdef USE_SOFTWARE_ECDH_IMPLEMENTATION
1840     // calculate DHKEY
1841     sm_sc_calculate_dhkey(setup->sm_dhkey);
1842     setup->sm_state_vars |= SM_STATE_VAR_DHKEY_CALCULATED;
1843 #endif
1844 
1845     if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_CALCULATED){
1846         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1847         return;
1848     } else {
1849         sm_conn->sm_engine_state = SM_SC_W4_CALCULATE_DHKEY;
1850     }
1851 
1852 }
1853 
1854 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1855     // calculate DHKCheck
1856     sm_key56_t bd_addr_master, bd_addr_slave;
1857     bd_addr_master[0] =  setup->sm_m_addr_type;
1858     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1859     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1860     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1861     uint8_t iocap_a[3];
1862     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1863     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1864     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1865     uint8_t iocap_b[3];
1866     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1867     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1868     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1869     if (IS_RESPONDER(sm_conn->sm_role)){
1870         // responder
1871         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1872     } else {
1873         // initiator
1874         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1875     }
1876 }
1877 
1878 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1879     // validate E = f6()
1880     sm_key56_t bd_addr_master, bd_addr_slave;
1881     bd_addr_master[0] =  setup->sm_m_addr_type;
1882     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1883     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1884     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1885 
1886     uint8_t iocap_a[3];
1887     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1888     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1889     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1890     uint8_t iocap_b[3];
1891     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1892     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1893     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1894     if (IS_RESPONDER(sm_conn->sm_role)){
1895         // responder
1896         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1897     } else {
1898         // initiator
1899         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1900     }
1901 }
1902 
1903 
1904 //
1905 // Link Key Conversion Function h6
1906 //
1907 // h6(W, keyID) = AES-CMACW(keyID)
1908 // - W is 128 bits
1909 // - keyID is 32 bits
1910 static void h6_engine(sm_connection_t * sm_conn, const sm_key_t w, const uint32_t key_id){
1911     const uint16_t message_len = 4;
1912     sm_cmac_connection = sm_conn;
1913     big_endian_store_32(sm_cmac_sc_buffer, 0, key_id);
1914     log_info("h6 key");
1915     log_info_hexdump(w, 16);
1916     log_info("h6 message");
1917     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1918     sm_cmac_general_start(w, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1919 }
1920 
1921 // For SC, setup->sm_local_ltk holds full LTK (sm_ltk is already truncated)
1922 // Errata Service Release to the Bluetooth Specification: ESR09
1923 //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1924 //   "Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1925 static void h6_calculate_ilk(sm_connection_t * sm_conn){
1926     h6_engine(sm_conn, setup->sm_local_ltk, 0x746D7031);    // "tmp1"
1927 }
1928 
1929 static void h6_calculate_br_edr_link_key(sm_connection_t * sm_conn){
1930     h6_engine(sm_conn, setup->sm_t, 0x6c656272);    // "lebr"
1931 }
1932 
1933 #endif
1934 
1935 // key management legacy connections:
1936 // - potentially two different LTKs based on direction. each device stores LTK provided by peer
1937 // - master stores LTK, EDIV, RAND. responder optionally stored master LTK (only if it needs to reconnect)
1938 // - initiators reconnects: initiator uses stored LTK, EDIV, RAND generated by responder
1939 // - responder  reconnects: responder uses LTK receveived from master
1940 
1941 // key management secure connections:
1942 // - both devices store same LTK from ECDH key exchange.
1943 
1944 #if defined(ENABLE_LE_SECURE_CONNECTIONS) || defined(ENABLE_LE_CENTRAL)
1945 static void sm_load_security_info(sm_connection_t * sm_connection){
1946     int encryption_key_size;
1947     int authenticated;
1948     int authorized;
1949 
1950     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1951     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1952                                 &encryption_key_size, &authenticated, &authorized);
1953     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1954     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1955     sm_connection->sm_connection_authenticated = authenticated;
1956     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1957 }
1958 #endif
1959 
1960 #ifdef ENABLE_LE_PERIPHERAL
1961 static void sm_start_calculating_ltk_from_ediv_and_rand(sm_connection_t * sm_connection){
1962     memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1963     setup->sm_local_ediv = sm_connection->sm_local_ediv;
1964     // re-establish used key encryption size
1965     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1966     sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1967     // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1968     sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1969     log_info("sm: received ltk request with key size %u, authenticated %u",
1970             sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1971     sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1972 }
1973 #endif
1974 
1975 static void sm_run(void){
1976 
1977     btstack_linked_list_iterator_t it;
1978 
1979     // assert that stack has already bootet
1980     if (hci_get_state() != HCI_STATE_WORKING) return;
1981 
1982     // assert that we can send at least commands
1983     if (!hci_can_send_command_packet_now()) return;
1984 
1985     //
1986     // non-connection related behaviour
1987     //
1988 
1989     // distributed key generation
1990     switch (dkg_state){
1991         case DKG_CALC_IRK:
1992             // already busy?
1993             if (sm_aes128_state == SM_AES128_IDLE) {
1994                 // IRK = d1(IR, 1, 0)
1995                 sm_key_t d1_prime;
1996                 sm_d1_d_prime(1, 0, d1_prime);  // plaintext
1997                 dkg_next_state();
1998                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1999                 return;
2000             }
2001             break;
2002         case DKG_CALC_DHK:
2003             // already busy?
2004             if (sm_aes128_state == SM_AES128_IDLE) {
2005                 // DHK = d1(IR, 3, 0)
2006                 sm_key_t d1_prime;
2007                 sm_d1_d_prime(3, 0, d1_prime);  // plaintext
2008                 dkg_next_state();
2009                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
2010                 return;
2011             }
2012             break;
2013         default:
2014             break;
2015     }
2016 
2017 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2018     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
2019 #ifdef USE_SOFTWARE_ECDH_IMPLEMENTATION
2020         sm_random_start(NULL);
2021 #else
2022         ec_key_generation_state = EC_KEY_GENERATION_W4_KEY;
2023         hci_send_cmd(&hci_le_read_local_p256_public_key);
2024 #endif
2025         return;
2026     }
2027 #endif
2028 
2029     // random address updates
2030     switch (rau_state){
2031         case RAU_GET_RANDOM:
2032             rau_next_state();
2033             sm_random_start(NULL);
2034             return;
2035         case RAU_GET_ENC:
2036             // already busy?
2037             if (sm_aes128_state == SM_AES128_IDLE) {
2038                 sm_key_t r_prime;
2039                 sm_ah_r_prime(sm_random_address, r_prime);
2040                 rau_next_state();
2041                 sm_aes128_start(sm_persistent_irk, r_prime, NULL);
2042                 return;
2043             }
2044             break;
2045         case RAU_SET_ADDRESS:
2046             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
2047             rau_state = RAU_IDLE;
2048             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
2049             return;
2050         default:
2051             break;
2052     }
2053 
2054 #ifdef ENABLE_CMAC_ENGINE
2055     // CMAC
2056     switch (sm_cmac_state){
2057         case CMAC_CALC_SUBKEYS:
2058         case CMAC_CALC_MI:
2059         case CMAC_CALC_MLAST:
2060             // already busy?
2061             if (sm_aes128_state == SM_AES128_ACTIVE) break;
2062             sm_cmac_handle_aes_engine_ready();
2063             return;
2064         default:
2065             break;
2066     }
2067 #endif
2068 
2069     // CSRK Lookup
2070     // -- if csrk lookup ready, find connection that require csrk lookup
2071     if (sm_address_resolution_idle()){
2072         hci_connections_get_iterator(&it);
2073         while(btstack_linked_list_iterator_has_next(&it)){
2074             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2075             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
2076             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
2077                 // and start lookup
2078                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
2079                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
2080                 break;
2081             }
2082         }
2083     }
2084 
2085     // -- if csrk lookup ready, resolved addresses for received addresses
2086     if (sm_address_resolution_idle()) {
2087         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
2088             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
2089             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
2090             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
2091             btstack_memory_sm_lookup_entry_free(entry);
2092         }
2093     }
2094 
2095     // -- Continue with CSRK device lookup by public or resolvable private address
2096     if (!sm_address_resolution_idle()){
2097         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_max_count());
2098         while (sm_address_resolution_test < le_device_db_max_count()){
2099             int addr_type;
2100             bd_addr_t addr;
2101             sm_key_t irk;
2102             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
2103             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
2104 
2105             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
2106                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
2107                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2108                 break;
2109             }
2110 
2111             if (sm_address_resolution_addr_type == 0){
2112                 sm_address_resolution_test++;
2113                 continue;
2114             }
2115 
2116             if (sm_aes128_state == SM_AES128_ACTIVE) break;
2117 
2118             log_info("LE Device Lookup: calculate AH");
2119             log_info_key("IRK", irk);
2120 
2121             sm_key_t r_prime;
2122             sm_ah_r_prime(sm_address_resolution_address, r_prime);
2123             sm_address_resolution_ah_calculation_active = 1;
2124             sm_aes128_start(irk, r_prime, sm_address_resolution_context);   // keep context
2125             return;
2126         }
2127 
2128         if (sm_address_resolution_test >= le_device_db_max_count()){
2129             log_info("LE Device Lookup: not found");
2130             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
2131         }
2132     }
2133 
2134 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2135     // TODO: we need to verify that nobody's already waiting for random data
2136     switch (sm_sc_oob_state){
2137         case SM_SC_OOB_W2_GET_RANDOM_1:
2138             sm_sc_oob_state = SM_SC_OOB_W4_RANDOM_1;
2139             sm_random_start(NULL);
2140             return;
2141         case SM_SC_OOB_W2_GET_RANDOM_2:
2142             sm_sc_oob_state = SM_SC_OOB_W4_RANDOM_2;
2143             sm_random_start(NULL);
2144             return;
2145         case SM_SC_OOB_W2_CALC_CONFIRM:
2146             if (!sm_cmac_ready()) break;
2147             if (ec_key_generation_state != EC_KEY_GENERATION_DONE) break;
2148             sm_sc_oob_state = SM_SC_OOB_W4_CONFIRM;
2149             f4_engine(NULL, ec_q, ec_q, sm_sc_oob_random, 0);
2150             break;
2151         default:
2152             break;
2153     }
2154 #endif
2155 
2156     // handle basic actions that don't requires the full context
2157     hci_connections_get_iterator(&it);
2158     while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
2159         hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2160         sm_connection_t  * sm_connection = &hci_connection->sm_connection;
2161         switch(sm_connection->sm_engine_state){
2162             // responder side
2163             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
2164                 sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2165                 hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2166                 return;
2167 
2168 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2169             case SM_SC_RECEIVED_LTK_REQUEST:
2170                 switch (sm_connection->sm_irk_lookup_state){
2171                     case IRK_LOOKUP_FAILED:
2172                         log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Failed)");
2173                         sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2174                         hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2175                         return;
2176                     default:
2177                         break;
2178                 }
2179                 break;
2180 #endif
2181             default:
2182                 break;
2183         }
2184     }
2185 
2186     //
2187     // active connection handling
2188     // -- use loop to handle next connection if lock on setup context is released
2189 
2190     while (1) {
2191 
2192         // Find connections that requires setup context and make active if no other is locked
2193         hci_connections_get_iterator(&it);
2194         while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
2195             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2196             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
2197             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
2198             int done = 1;
2199             int err;
2200             UNUSED(err);
2201             switch (sm_connection->sm_engine_state) {
2202 #ifdef ENABLE_LE_PERIPHERAL
2203                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
2204                     // send packet if possible,
2205                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
2206                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
2207                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
2208                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2209                     } else {
2210                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2211                     }
2212                     // don't lock sxetup context yet
2213                     done = 0;
2214                     break;
2215                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
2216                     sm_reset_setup();
2217                     sm_init_setup(sm_connection);
2218                     // recover pairing request
2219                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
2220                     err = sm_stk_generation_init(sm_connection);
2221 
2222 #ifdef ENABLE_TESTING_SUPPORT
2223                     if (0 < test_pairing_failure && test_pairing_failure < SM_REASON_DHKEY_CHECK_FAILED){
2224                         log_info("testing_support: respond with pairing failure %u", test_pairing_failure);
2225                         err = test_pairing_failure;
2226                     }
2227 #endif
2228                     if (err){
2229                         setup->sm_pairing_failed_reason = err;
2230                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2231                         break;
2232                     }
2233                     sm_timeout_start(sm_connection);
2234                     // generate random number first, if we need to show passkey
2235                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
2236                         sm_connection->sm_engine_state = SM_PH2_GET_RANDOM_TK;
2237                         break;
2238                     }
2239                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2240                     break;
2241                 case SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST:
2242                     sm_reset_setup();
2243                     sm_start_calculating_ltk_from_ediv_and_rand(sm_connection);
2244                     break;
2245 #endif
2246 #ifdef ENABLE_LE_CENTRAL
2247                 case SM_INITIATOR_PH0_HAS_LTK:
2248                     sm_reset_setup();
2249                     sm_load_security_info(sm_connection);
2250                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
2251                     break;
2252                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
2253                     sm_reset_setup();
2254                     sm_init_setup(sm_connection);
2255                     sm_timeout_start(sm_connection);
2256                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
2257                     break;
2258 #endif
2259 
2260 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2261                 case SM_SC_RECEIVED_LTK_REQUEST:
2262                     switch (sm_connection->sm_irk_lookup_state){
2263                         case IRK_LOOKUP_SUCCEEDED:
2264                             // assuming Secure Connection, we have a stored LTK and the EDIV/RAND are null
2265                             // start using context by loading security info
2266                             sm_reset_setup();
2267                             sm_load_security_info(sm_connection);
2268                             if (setup->sm_peer_ediv == 0 && sm_is_null_random(setup->sm_peer_rand) && !sm_is_null_key(setup->sm_peer_ltk)){
2269                                 memcpy(setup->sm_ltk, setup->sm_peer_ltk, 16);
2270                                 sm_connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2271                                 break;
2272                             }
2273                             log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Succeeded)");
2274                             sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2275                             hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2276                             // don't lock setup context yet
2277                             return;
2278                         default:
2279                             // just wait until IRK lookup is completed
2280                             // don't lock setup context yet
2281                             done = 0;
2282                             break;
2283                     }
2284                     break;
2285 #endif
2286                 default:
2287                     done = 0;
2288                     break;
2289             }
2290             if (done){
2291                 sm_active_connection_handle = sm_connection->sm_handle;
2292                 log_info("sm: connection 0x%04x locked setup context as %s, state %u", sm_active_connection_handle, sm_connection->sm_role ? "responder" : "initiator", sm_connection->sm_engine_state);
2293             }
2294         }
2295 
2296         //
2297         // active connection handling
2298         //
2299 
2300         if (sm_active_connection_handle == HCI_CON_HANDLE_INVALID) return;
2301 
2302         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection_handle);
2303         if (!connection) {
2304             log_info("no connection for handle 0x%04x", sm_active_connection_handle);
2305             return;
2306         }
2307 
2308 #if defined(ENABLE_LE_SECURE_CONNECTIONS) && !defined(USE_SOFTWARE_ECDH_IMPLEMENTATION)
2309         if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_NEEDED){
2310             setup->sm_state_vars &= ~SM_STATE_VAR_DHKEY_NEEDED;
2311             hci_send_cmd(&hci_le_generate_dhkey, &setup->sm_peer_q[0], &setup->sm_peer_q[32]);
2312             return;
2313         }
2314 #endif
2315 
2316         // assert that we could send a SM PDU - not needed for all of the following
2317         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
2318             log_info("cannot send now, requesting can send now event");
2319             l2cap_request_can_send_fix_channel_now_event(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2320             return;
2321         }
2322 
2323         // send keypress notifications
2324         if (setup->sm_keypress_notification){
2325             int i;
2326             uint8_t flags       = setup->sm_keypress_notification & 0x1f;
2327             uint8_t num_actions = setup->sm_keypress_notification >> 5;
2328             uint8_t action = 0;
2329             for (i=SM_KEYPRESS_PASSKEY_ENTRY_STARTED;i<=SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED;i++){
2330                 if (flags & (1<<i)){
2331                     int clear_flag = 1;
2332                     switch (i){
2333                         case SM_KEYPRESS_PASSKEY_ENTRY_STARTED:
2334                         case SM_KEYPRESS_PASSKEY_CLEARED:
2335                         case SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED:
2336                         default:
2337                             break;
2338                         case SM_KEYPRESS_PASSKEY_DIGIT_ENTERED:
2339                         case SM_KEYPRESS_PASSKEY_DIGIT_ERASED:
2340                             num_actions--;
2341                             clear_flag = num_actions == 0;
2342                             break;
2343                     }
2344                     if (clear_flag){
2345                         flags &= ~(1<<i);
2346                     }
2347                     action = i;
2348                     break;
2349                 }
2350             }
2351             setup->sm_keypress_notification = (num_actions << 5) | flags;
2352 
2353             // send keypress notification
2354             uint8_t buffer[2];
2355             buffer[0] = SM_CODE_KEYPRESS_NOTIFICATION;
2356             buffer[1] = action;
2357             l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2358 
2359             // try
2360             l2cap_request_can_send_fix_channel_now_event(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2361             return;
2362         }
2363 
2364         sm_key_t plaintext;
2365         int key_distribution_flags;
2366         UNUSED(key_distribution_flags);
2367 
2368         log_info("sm_run: state %u", connection->sm_engine_state);
2369         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
2370             log_info("sm_run // cannot send");
2371         }
2372         switch (connection->sm_engine_state){
2373 
2374             // general
2375             case SM_GENERAL_SEND_PAIRING_FAILED: {
2376                 uint8_t buffer[2];
2377                 buffer[0] = SM_CODE_PAIRING_FAILED;
2378                 buffer[1] = setup->sm_pairing_failed_reason;
2379                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2380                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2381                 sm_notify_client_status_reason(connection, ERROR_CODE_AUTHENTICATION_FAILURE, setup->sm_pairing_failed_reason);
2382                 sm_done_for_handle(connection->sm_handle);
2383                 break;
2384             }
2385 
2386             // responding state
2387 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2388             case SM_SC_W2_GET_RANDOM_A:
2389                 sm_random_start(connection);
2390                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_A;
2391                 break;
2392             case SM_SC_W2_GET_RANDOM_B:
2393                 sm_random_start(connection);
2394                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_B;
2395                 break;
2396             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
2397                 if (!sm_cmac_ready()) break;
2398                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
2399                 sm_sc_calculate_local_confirm(connection);
2400                 break;
2401             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
2402                 if (!sm_cmac_ready()) break;
2403                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
2404                 sm_sc_calculate_remote_confirm(connection);
2405                 break;
2406             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
2407                 if (!sm_cmac_ready()) break;
2408                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
2409                 sm_sc_calculate_f6_for_dhkey_check(connection);
2410                 break;
2411             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
2412                 if (!sm_cmac_ready()) break;
2413                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
2414                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
2415                 break;
2416             case SM_SC_W2_CALCULATE_F5_SALT:
2417                 if (!sm_cmac_ready()) break;
2418                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
2419                 f5_calculate_salt(connection);
2420                 break;
2421             case SM_SC_W2_CALCULATE_F5_MACKEY:
2422                 if (!sm_cmac_ready()) break;
2423                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
2424                 f5_calculate_mackey(connection);
2425                 break;
2426             case SM_SC_W2_CALCULATE_F5_LTK:
2427                 if (!sm_cmac_ready()) break;
2428                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
2429                 f5_calculate_ltk(connection);
2430                 break;
2431             case SM_SC_W2_CALCULATE_G2:
2432                 if (!sm_cmac_ready()) break;
2433                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2434                 g2_calculate(connection);
2435                 break;
2436             case SM_SC_W2_CALCULATE_H6_ILK:
2437                 if (!sm_cmac_ready()) break;
2438                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_ILK;
2439                 h6_calculate_ilk(connection);
2440                 break;
2441             case SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY:
2442                 if (!sm_cmac_ready()) break;
2443                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY;
2444                 h6_calculate_br_edr_link_key(connection);
2445                 break;
2446 #endif
2447 
2448 #ifdef ENABLE_LE_CENTRAL
2449             // initiator side
2450             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
2451                 sm_key_t peer_ltk_flipped;
2452                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
2453                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2454                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2455                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2456                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2457                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2458                 return;
2459             }
2460 
2461             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2462                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2463                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2464                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2465                 sm_timeout_reset(connection);
2466                 break;
2467 #endif
2468 
2469 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2470 
2471             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2472                 int trigger_user_response = 0;
2473 
2474                 uint8_t buffer[65];
2475                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2476                 //
2477                 reverse_256(&ec_q[0],  &buffer[1]);
2478                 reverse_256(&ec_q[32], &buffer[33]);
2479 
2480                 // stk generation method
2481                 // passkey entry: notify app to show passkey or to request passkey
2482                 switch (setup->sm_stk_generation_method){
2483                     case JUST_WORKS:
2484                     case NK_BOTH_INPUT:
2485                         if (IS_RESPONDER(connection->sm_role)){
2486                             // responder
2487                             sm_sc_start_calculating_local_confirm(connection);
2488                         } else {
2489                             // initiator
2490                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2491                         }
2492                         break;
2493                     case PK_INIT_INPUT:
2494                     case PK_RESP_INPUT:
2495                     case OK_BOTH_INPUT:
2496                         // use random TK for display
2497                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2498                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2499                         setup->sm_passkey_bit = 0;
2500 
2501                         if (IS_RESPONDER(connection->sm_role)){
2502                             // responder
2503                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2504                         } else {
2505                             // initiator
2506                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2507                         }
2508                         trigger_user_response = 1;
2509                         break;
2510                     case OOB:
2511                         if (IS_RESPONDER(connection->sm_role)){
2512                             // responder
2513                             connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2514                         } else {
2515                             // initiator
2516                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2517                         }
2518                         break;
2519                 }
2520 
2521                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2522                 sm_timeout_reset(connection);
2523 
2524                 // trigger user response after sending pdu
2525                 if (trigger_user_response){
2526                     sm_trigger_user_response(connection);
2527                 }
2528                 break;
2529             }
2530             case SM_SC_SEND_CONFIRMATION: {
2531                 uint8_t buffer[17];
2532                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2533                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2534                 if (IS_RESPONDER(connection->sm_role)){
2535                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2536                 } else {
2537                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2538                 }
2539                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2540                 sm_timeout_reset(connection);
2541                 break;
2542             }
2543             case SM_SC_SEND_PAIRING_RANDOM: {
2544                 uint8_t buffer[17];
2545                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2546                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2547                 log_info("stk method %u, num bits %u", setup->sm_stk_generation_method, setup->sm_passkey_bit);
2548                 if (sm_passkey_entry(setup->sm_stk_generation_method) && setup->sm_passkey_bit < 20){
2549                     log_info("SM_SC_SEND_PAIRING_RANDOM A");
2550                     if (IS_RESPONDER(connection->sm_role)){
2551                         // responder
2552                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2553                     } else {
2554                         // initiator
2555                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2556                     }
2557                 } else {
2558                     log_info("SM_SC_SEND_PAIRING_RANDOM B");
2559                     if (IS_RESPONDER(connection->sm_role)){
2560                         // responder
2561                         if (setup->sm_stk_generation_method == NK_BOTH_INPUT){
2562                             log_info("SM_SC_SEND_PAIRING_RANDOM B1");
2563                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2564                         } else {
2565                             log_info("SM_SC_SEND_PAIRING_RANDOM B2");
2566                             sm_sc_prepare_dhkey_check(connection);
2567                         }
2568                     } else {
2569                         // initiator
2570                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2571                     }
2572                 }
2573                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2574                 sm_timeout_reset(connection);
2575                 break;
2576             }
2577             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2578                 uint8_t buffer[17];
2579                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2580                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2581 
2582                 if (IS_RESPONDER(connection->sm_role)){
2583                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2584                 } else {
2585                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2586                 }
2587 
2588                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2589                 sm_timeout_reset(connection);
2590                 break;
2591             }
2592 
2593 #endif
2594 
2595 #ifdef ENABLE_LE_PERIPHERAL
2596             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2597                 // echo initiator for now
2598                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2599                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2600 
2601                 if (setup->sm_use_secure_connections){
2602                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2603                     // skip LTK/EDIV for SC
2604                     log_info("sm: dropping encryption information flag");
2605                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2606                 } else {
2607                     connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2608                 }
2609 
2610                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2611                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2612                 // update key distribution after ENC was dropped
2613                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
2614 
2615                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2616                 sm_timeout_reset(connection);
2617                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2618                 if (!setup->sm_use_secure_connections || setup->sm_stk_generation_method == JUST_WORKS){
2619                     sm_trigger_user_response(connection);
2620                 }
2621                 return;
2622 #endif
2623 
2624             case SM_PH2_SEND_PAIRING_RANDOM: {
2625                 uint8_t buffer[17];
2626                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2627                 reverse_128(setup->sm_local_random, &buffer[1]);
2628                 if (IS_RESPONDER(connection->sm_role)){
2629                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2630                 } else {
2631                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2632                 }
2633                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2634                 sm_timeout_reset(connection);
2635                 break;
2636             }
2637 
2638             case SM_PH2_GET_RANDOM_TK:
2639             case SM_PH2_C1_GET_RANDOM_A:
2640             case SM_PH2_C1_GET_RANDOM_B:
2641             case SM_PH3_GET_RANDOM:
2642             case SM_PH3_GET_DIV:
2643                 sm_next_responding_state(connection);
2644                 sm_random_start(connection);
2645                 return;
2646 
2647             case SM_PH2_C1_GET_ENC_B:
2648             case SM_PH2_C1_GET_ENC_D:
2649                 // already busy?
2650                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2651                 sm_next_responding_state(connection);
2652                 sm_aes128_start(setup->sm_tk, setup->sm_c1_t3_value, connection);
2653                 return;
2654 
2655             case SM_PH3_LTK_GET_ENC:
2656             case SM_RESPONDER_PH4_LTK_GET_ENC:
2657                 // already busy?
2658                 if (sm_aes128_state == SM_AES128_IDLE) {
2659                     sm_key_t d_prime;
2660                     sm_d1_d_prime(setup->sm_local_div, 0, d_prime);
2661                     sm_next_responding_state(connection);
2662                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2663                     return;
2664                 }
2665                 break;
2666 
2667             case SM_PH3_CSRK_GET_ENC:
2668                 // already busy?
2669                 if (sm_aes128_state == SM_AES128_IDLE) {
2670                     sm_key_t d_prime;
2671                     sm_d1_d_prime(setup->sm_local_div, 1, d_prime);
2672                     sm_next_responding_state(connection);
2673                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2674                     return;
2675                 }
2676                 break;
2677 
2678             case SM_PH2_C1_GET_ENC_C:
2679                 // already busy?
2680                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2681                 // calculate m_confirm using aes128 engine - step 1
2682                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2683                 sm_next_responding_state(connection);
2684                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2685                 break;
2686             case SM_PH2_C1_GET_ENC_A:
2687                 // already busy?
2688                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2689                 // calculate confirm using aes128 engine - step 1
2690                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2691                 sm_next_responding_state(connection);
2692                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2693                 break;
2694             case SM_PH2_CALC_STK:
2695                 // already busy?
2696                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2697                 // calculate STK
2698                 if (IS_RESPONDER(connection->sm_role)){
2699                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, plaintext);
2700                 } else {
2701                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, plaintext);
2702                 }
2703                 sm_next_responding_state(connection);
2704                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2705                 break;
2706             case SM_PH3_Y_GET_ENC:
2707                 // already busy?
2708                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2709                 // PH3B2 - calculate Y from      - enc
2710                 // Y = dm(DHK, Rand)
2711                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2712                 sm_next_responding_state(connection);
2713                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2714                 return;
2715             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2716                 uint8_t buffer[17];
2717                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2718                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2719                 if (IS_RESPONDER(connection->sm_role)){
2720                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2721                 } else {
2722                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2723                 }
2724                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2725                 sm_timeout_reset(connection);
2726                 return;
2727             }
2728 #ifdef ENABLE_LE_PERIPHERAL
2729             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2730                 sm_key_t stk_flipped;
2731                 reverse_128(setup->sm_ltk, stk_flipped);
2732                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2733                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2734                 return;
2735             }
2736             case SM_RESPONDER_PH4_SEND_LTK_REPLY: {
2737                 sm_key_t ltk_flipped;
2738                 reverse_128(setup->sm_ltk, ltk_flipped);
2739                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2740                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2741                 sm_done_for_handle(connection->sm_handle);
2742                 return;
2743             }
2744             case SM_RESPONDER_PH4_Y_GET_ENC:
2745                 // already busy?
2746                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2747                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2748                 // Y = dm(DHK, Rand)
2749                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2750                 sm_next_responding_state(connection);
2751                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2752                 return;
2753 #endif
2754 #ifdef ENABLE_LE_CENTRAL
2755             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2756                 sm_key_t stk_flipped;
2757                 reverse_128(setup->sm_ltk, stk_flipped);
2758                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2759                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2760                 return;
2761             }
2762 #endif
2763 
2764             case SM_PH3_DISTRIBUTE_KEYS:
2765                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2766                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2767                     uint8_t buffer[17];
2768                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2769                     reverse_128(setup->sm_ltk, &buffer[1]);
2770                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2771                     sm_timeout_reset(connection);
2772                     return;
2773                 }
2774                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2775                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2776                     uint8_t buffer[11];
2777                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2778                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2779                     reverse_64(setup->sm_local_rand, &buffer[3]);
2780                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2781                     sm_timeout_reset(connection);
2782                     return;
2783                 }
2784                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2785                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2786                     uint8_t buffer[17];
2787                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2788                     reverse_128(sm_persistent_irk, &buffer[1]);
2789                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2790                     sm_timeout_reset(connection);
2791                     return;
2792                 }
2793                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2794                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2795                     bd_addr_t local_address;
2796                     uint8_t buffer[8];
2797                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2798                     switch (gap_random_address_get_mode()){
2799                         case GAP_RANDOM_ADDRESS_TYPE_OFF:
2800                         case GAP_RANDOM_ADDRESS_TYPE_STATIC:
2801                             // public or static random
2802                             gap_le_get_own_address(&buffer[1], local_address);
2803                             break;
2804                         case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2805                         case GAP_RANDOM_ADDRESS_RESOLVABLE:
2806                             // fallback to public
2807                             gap_local_bd_addr(local_address);
2808                             buffer[1] = 0;
2809                             break;
2810                     }
2811                     reverse_bd_addr(local_address, &buffer[2]);
2812                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2813                     sm_timeout_reset(connection);
2814                     return;
2815                 }
2816                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2817                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2818 
2819                     // hack to reproduce test runs
2820                     if (test_use_fixed_local_csrk){
2821                         memset(setup->sm_local_csrk, 0xcc, 16);
2822                     }
2823 
2824                     uint8_t buffer[17];
2825                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2826                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2827                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2828                     sm_timeout_reset(connection);
2829                     return;
2830                 }
2831 
2832                 // keys are sent
2833                 if (IS_RESPONDER(connection->sm_role)){
2834                     // slave -> receive master keys if any
2835                     if (sm_key_distribution_all_received(connection)){
2836                         sm_key_distribution_handle_all_received(connection);
2837                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2838                         sm_notify_client_status_reason(connection, ERROR_CODE_SUCCESS, 0);
2839                         sm_done_for_handle(connection->sm_handle);
2840                     } else {
2841                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2842                     }
2843                 } else {
2844                     // master -> all done
2845                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2846                     sm_notify_client_status_reason(connection, ERROR_CODE_SUCCESS, 0);
2847                     sm_done_for_handle(connection->sm_handle);
2848                 }
2849                 break;
2850 
2851             default:
2852                 break;
2853         }
2854 
2855         // check again if active connection was released
2856         if (sm_active_connection_handle != HCI_CON_HANDLE_INVALID) break;
2857     }
2858 }
2859 
2860 // note: aes engine is ready as we just got the aes result
2861 static void sm_handle_encryption_result(uint8_t * data){
2862 
2863     sm_aes128_state = SM_AES128_IDLE;
2864 
2865     if (sm_address_resolution_ah_calculation_active){
2866         sm_address_resolution_ah_calculation_active = 0;
2867         // compare calulated address against connecting device
2868         uint8_t hash[3];
2869         reverse_24(data, hash);
2870         if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2871             log_info("LE Device Lookup: matched resolvable private address");
2872             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2873             return;
2874         }
2875         // no match, try next
2876         sm_address_resolution_test++;
2877         return;
2878     }
2879 
2880     switch (dkg_state){
2881         case DKG_W4_IRK:
2882             reverse_128(data, sm_persistent_irk);
2883             log_info_key("irk", sm_persistent_irk);
2884             dkg_next_state();
2885             return;
2886         case DKG_W4_DHK:
2887             reverse_128(data, sm_persistent_dhk);
2888             log_info_key("dhk", sm_persistent_dhk);
2889             dkg_next_state();
2890             // SM Init Finished
2891             return;
2892         default:
2893             break;
2894     }
2895 
2896     switch (rau_state){
2897         case RAU_W4_ENC:
2898             reverse_24(data, &sm_random_address[3]);
2899             rau_next_state();
2900             return;
2901         default:
2902             break;
2903     }
2904 
2905 #ifdef ENABLE_CMAC_ENGINE
2906     switch (sm_cmac_state){
2907         case CMAC_W4_SUBKEYS:
2908         case CMAC_W4_MI:
2909         case CMAC_W4_MLAST:
2910             {
2911             sm_key_t t;
2912             reverse_128(data, t);
2913             sm_cmac_handle_encryption_result(t);
2914             }
2915             return;
2916         default:
2917             break;
2918     }
2919 #endif
2920 
2921     // retrieve sm_connection provided to sm_aes128_start_encryption
2922     sm_connection_t * connection = (sm_connection_t*) sm_aes128_context;
2923     if (!connection) return;
2924     switch (connection->sm_engine_state){
2925         case SM_PH2_C1_W4_ENC_A:
2926         case SM_PH2_C1_W4_ENC_C:
2927             {
2928             sm_key_t t2;
2929             reverse_128(data, t2);
2930             sm_c1_t3(t2, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2931             }
2932             sm_next_responding_state(connection);
2933             return;
2934         case SM_PH2_C1_W4_ENC_B:
2935             reverse_128(data, setup->sm_local_confirm);
2936             log_info_key("c1!", setup->sm_local_confirm);
2937             connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2938             return;
2939         case SM_PH2_C1_W4_ENC_D:
2940             {
2941             sm_key_t peer_confirm_test;
2942             reverse_128(data, peer_confirm_test);
2943             log_info_key("c1!", peer_confirm_test);
2944             if (memcmp(setup->sm_peer_confirm, peer_confirm_test, 16) != 0){
2945                 setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2946                 connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2947                 return;
2948             }
2949             if (IS_RESPONDER(connection->sm_role)){
2950                 connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2951             } else {
2952                 connection->sm_engine_state = SM_PH2_CALC_STK;
2953             }
2954             }
2955             return;
2956         case SM_PH2_W4_STK:
2957             reverse_128(data, setup->sm_ltk);
2958             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2959             log_info_key("stk", setup->sm_ltk);
2960             if (IS_RESPONDER(connection->sm_role)){
2961                 connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2962             } else {
2963                 connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2964             }
2965             return;
2966         case SM_PH3_Y_W4_ENC:{
2967             sm_key_t y128;
2968             reverse_128(data, y128);
2969             setup->sm_local_y = big_endian_read_16(y128, 14);
2970             log_info_hex16("y", setup->sm_local_y);
2971             // PH3B3 - calculate EDIV
2972             setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2973             log_info_hex16("ediv", setup->sm_local_ediv);
2974             // PH3B4 - calculate LTK         - enc
2975             // LTK = d1(ER, DIV, 0))
2976             connection->sm_engine_state = SM_PH3_LTK_GET_ENC;
2977             return;
2978         }
2979         case SM_RESPONDER_PH4_Y_W4_ENC:{
2980             sm_key_t y128;
2981             reverse_128(data, y128);
2982             setup->sm_local_y = big_endian_read_16(y128, 14);
2983             log_info_hex16("y", setup->sm_local_y);
2984 
2985             // PH3B3 - calculate DIV
2986             setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2987             log_info_hex16("ediv", setup->sm_local_ediv);
2988             // PH3B4 - calculate LTK         - enc
2989             // LTK = d1(ER, DIV, 0))
2990             connection->sm_engine_state = SM_RESPONDER_PH4_LTK_GET_ENC;
2991             return;
2992         }
2993         case SM_PH3_LTK_W4_ENC:
2994             reverse_128(data, setup->sm_ltk);
2995             log_info_key("ltk", setup->sm_ltk);
2996             // calc CSRK next
2997             connection->sm_engine_state = SM_PH3_CSRK_GET_ENC;
2998             return;
2999         case SM_PH3_CSRK_W4_ENC:
3000             reverse_128(data, setup->sm_local_csrk);
3001             log_info_key("csrk", setup->sm_local_csrk);
3002             if (setup->sm_key_distribution_send_set){
3003                 connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3004             } else {
3005                 // no keys to send, just continue
3006                 if (IS_RESPONDER(connection->sm_role)){
3007                     // slave -> receive master keys
3008                     connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3009                 } else {
3010                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
3011                         connection->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
3012                     } else {
3013                         // master -> all done
3014                         connection->sm_engine_state = SM_INITIATOR_CONNECTED;
3015                         sm_notify_client_status_reason(connection, ERROR_CODE_SUCCESS, 0);
3016                         sm_done_for_handle(connection->sm_handle);
3017                     }
3018                 }
3019             }
3020             return;
3021 #ifdef ENABLE_LE_PERIPHERAL
3022         case SM_RESPONDER_PH4_LTK_W4_ENC:
3023             reverse_128(data, setup->sm_ltk);
3024             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
3025             log_info_key("ltk", setup->sm_ltk);
3026             connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
3027             return;
3028 #endif
3029         default:
3030             break;
3031     }
3032 }
3033 
3034 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3035 
3036 #if (defined(USE_MICRO_ECC_FOR_ECDH) && !defined(WICED_VERSION)) || defined(USE_MBEDTLS_FOR_ECDH)
3037 // @return OK
3038 static int sm_generate_f_rng(unsigned char * buffer, unsigned size){
3039     if (ec_key_generation_state != EC_KEY_GENERATION_ACTIVE) return 0;
3040     int offset = setup->sm_passkey_bit;
3041     log_info("sm_generate_f_rng: size %u - offset %u", (int) size, offset);
3042     while (size) {
3043         *buffer++ = setup->sm_peer_q[offset++];
3044         size--;
3045     }
3046     setup->sm_passkey_bit = offset;
3047     return 1;
3048 }
3049 #endif
3050 #ifdef USE_MBEDTLS_FOR_ECDH
3051 // @return error - just wrap sm_generate_f_rng
3052 static int sm_generate_f_rng_mbedtls(void * context, unsigned char * buffer, size_t size){
3053     UNUSED(context);
3054     return sm_generate_f_rng(buffer, size) == 0;
3055 }
3056 #endif /* USE_MBEDTLS_FOR_ECDH */
3057 #endif /* ENABLE_LE_SECURE_CONNECTIONS */
3058 
3059 // note: random generator is ready. this doesn NOT imply that aes engine is unused!
3060 static void sm_handle_random_result(uint8_t * data){
3061 
3062 #if defined(ENABLE_LE_SECURE_CONNECTIONS) && defined(USE_SOFTWARE_ECDH_IMPLEMENTATION)
3063 
3064     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
3065         int num_bytes = setup->sm_passkey_bit;
3066         memcpy(&setup->sm_peer_q[num_bytes], data, 8);
3067         num_bytes += 8;
3068         setup->sm_passkey_bit = num_bytes;
3069 
3070         if (num_bytes >= 64){
3071 
3072             // init pre-generated random data from sm_peer_q
3073             setup->sm_passkey_bit = 0;
3074 
3075             // generate EC key
3076 #ifdef USE_MICRO_ECC_FOR_ECDH
3077 
3078 #ifndef WICED_VERSION
3079             log_info("set uECC RNG for initial key generation with 64 random bytes");
3080             // micro-ecc from WICED SDK uses its wiced_crypto_get_random by default - no need to set it
3081             uECC_set_rng(&sm_generate_f_rng);
3082 #endif /* WICED_VERSION */
3083 
3084 #if uECC_SUPPORTS_secp256r1
3085             // standard version
3086             uECC_make_key(ec_q, ec_d, uECC_secp256r1());
3087 
3088             // disable RNG again, as returning no randmon data lets shared key generation fail
3089             log_info("disable uECC RNG in standard version after key generation");
3090             uECC_set_rng(NULL);
3091 #else
3092             // static version
3093             uECC_make_key(ec_q, ec_d);
3094 #endif
3095 #endif /* USE_MICRO_ECC_FOR_ECDH */
3096 
3097 #ifdef USE_MBEDTLS_FOR_ECDH
3098             mbedtls_mpi d;
3099             mbedtls_ecp_point P;
3100             mbedtls_mpi_init(&d);
3101             mbedtls_ecp_point_init(&P);
3102             int res = mbedtls_ecp_gen_keypair(&mbedtls_ec_group, &d, &P, &sm_generate_f_rng_mbedtls, NULL);
3103             log_info("gen keypair %x", res);
3104             mbedtls_mpi_write_binary(&P.X, &ec_q[0],  32);
3105             mbedtls_mpi_write_binary(&P.Y, &ec_q[32], 32);
3106             mbedtls_mpi_write_binary(&d, ec_d, 32);
3107             mbedtls_ecp_point_free(&P);
3108             mbedtls_mpi_free(&d);
3109 #endif  /* USE_MBEDTLS_FOR_ECDH */
3110 
3111             ec_key_generation_state = EC_KEY_GENERATION_DONE;
3112             log_info("Elliptic curve: d");
3113             log_info_hexdump(ec_d,32);
3114             sm_log_ec_keypair();
3115         }
3116     }
3117 #endif
3118 
3119     switch (rau_state){
3120         case RAU_W4_RANDOM:
3121             // non-resolvable vs. resolvable
3122             switch (gap_random_adress_type){
3123                 case GAP_RANDOM_ADDRESS_RESOLVABLE:
3124                     // resolvable: use random as prand and calc address hash
3125                     // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
3126                     memcpy(sm_random_address, data, 3);
3127                     sm_random_address[0] &= 0x3f;
3128                     sm_random_address[0] |= 0x40;
3129                     rau_state = RAU_GET_ENC;
3130                     break;
3131                 case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
3132                 default:
3133                     // "The two most significant bits of the address shall be equal to ‘0’""
3134                     memcpy(sm_random_address, data, 6);
3135                     sm_random_address[0] &= 0x3f;
3136                     rau_state = RAU_SET_ADDRESS;
3137                     break;
3138             }
3139             return;
3140         default:
3141             break;
3142     }
3143 
3144 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3145     switch (sm_sc_oob_state){
3146         case SM_SC_OOB_W4_RANDOM_1:
3147             memcpy(&sm_sc_oob_random[0], data, 8);
3148             sm_sc_oob_state = SM_SC_OOB_W2_GET_RANDOM_2;
3149             return;
3150         case SM_SC_OOB_W4_RANDOM_2:
3151             memcpy(&sm_sc_oob_random[8], data, 8);
3152             sm_sc_oob_state = SM_SC_OOB_W2_CALC_CONFIRM;
3153             return;
3154         default:
3155             break;
3156     }
3157 #endif
3158 
3159     // retrieve sm_connection provided to sm_random_start
3160     sm_connection_t * connection = (sm_connection_t *) sm_random_context;
3161     if (!connection) return;
3162     switch (connection->sm_engine_state){
3163 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3164         case SM_SC_W4_GET_RANDOM_A:
3165             memcpy(&setup->sm_local_nonce[0], data, 8);
3166             connection->sm_engine_state = SM_SC_W2_GET_RANDOM_B;
3167             break;
3168         case SM_SC_W4_GET_RANDOM_B:
3169             memcpy(&setup->sm_local_nonce[8], data, 8);
3170             // OOB
3171             if (setup->sm_stk_generation_method == OOB){
3172                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3173                 break;
3174             }
3175             // initiator & jw/nc -> send pairing random
3176             if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3177                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3178                 break;
3179             } else {
3180                 connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
3181             }
3182             break;
3183 #endif
3184 
3185         case SM_PH2_W4_RANDOM_TK:
3186         {
3187             sm_reset_tk();
3188             uint32_t tk;
3189             if (sm_fixed_passkey_in_display_role == 0xffffffff){
3190                 // map random to 0-999999 without speding much cycles on a modulus operation
3191                 tk = little_endian_read_32(data,0);
3192                 tk = tk & 0xfffff;  // 1048575
3193                 if (tk >= 999999){
3194                     tk = tk - 999999;
3195                 }
3196             } else {
3197                 // override with pre-defined passkey
3198                 tk = sm_fixed_passkey_in_display_role;
3199             }
3200             big_endian_store_32(setup->sm_tk, 12, tk);
3201             if (IS_RESPONDER(connection->sm_role)){
3202                 connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
3203             } else {
3204                 if (setup->sm_use_secure_connections){
3205                     connection->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3206                 } else {
3207                     connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3208                     sm_trigger_user_response(connection);
3209                     // response_idle == nothing <--> sm_trigger_user_response() did not require response
3210                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3211                         connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3212                     }
3213                 }
3214             }
3215             return;
3216         }
3217         case SM_PH2_C1_W4_RANDOM_A:
3218             memcpy(&setup->sm_local_random[0], data, 8); // random endinaness
3219             connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_B;
3220             return;
3221         case SM_PH2_C1_W4_RANDOM_B:
3222             memcpy(&setup->sm_local_random[8], data, 8); // random endinaness
3223             connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
3224             return;
3225         case SM_PH3_W4_RANDOM:
3226             reverse_64(data, setup->sm_local_rand);
3227             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
3228             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
3229             // no db for authenticated flag hack: store flag in bit 4 of LSB
3230             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
3231             connection->sm_engine_state = SM_PH3_GET_DIV;
3232             return;
3233         case SM_PH3_W4_DIV:
3234             // use 16 bit from random value as div
3235             setup->sm_local_div = big_endian_read_16(data, 0);
3236             log_info_hex16("div", setup->sm_local_div);
3237             connection->sm_engine_state = SM_PH3_Y_GET_ENC;
3238             return;
3239         default:
3240             break;
3241     }
3242 }
3243 
3244 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
3245 
3246     UNUSED(channel);    // ok: there is no channel
3247     UNUSED(size);       // ok: fixed format HCI events
3248 
3249     sm_connection_t  * sm_conn;
3250     hci_con_handle_t con_handle;
3251 
3252     switch (packet_type) {
3253 
3254 		case HCI_EVENT_PACKET:
3255 			switch (hci_event_packet_get_type(packet)) {
3256 
3257                 case BTSTACK_EVENT_STATE:
3258 					// bt stack activated, get started
3259 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
3260                         log_info("HCI Working!");
3261 
3262 
3263                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
3264 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3265                         if (!sm_have_ec_keypair){
3266                             setup->sm_passkey_bit = 0;
3267                             ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
3268                         }
3269 #endif
3270                         // trigger Random Address generation if requested before
3271                         switch (gap_random_adress_type){
3272                             case GAP_RANDOM_ADDRESS_TYPE_OFF:
3273                                 rau_state = RAU_IDLE;
3274                                 break;
3275                             case GAP_RANDOM_ADDRESS_TYPE_STATIC:
3276                                 rau_state = RAU_SET_ADDRESS;
3277                                 break;
3278                             default:
3279                                 rau_state = RAU_GET_RANDOM;
3280                                 break;
3281                         }
3282                         sm_run();
3283 					}
3284 					break;
3285 
3286                 case HCI_EVENT_LE_META:
3287                     switch (packet[2]) {
3288                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
3289 
3290                             log_info("sm: connected");
3291 
3292                             if (packet[3]) return; // connection failed
3293 
3294                             con_handle = little_endian_read_16(packet, 4);
3295                             sm_conn = sm_get_connection_for_handle(con_handle);
3296                             if (!sm_conn) break;
3297 
3298                             sm_conn->sm_handle = con_handle;
3299                             sm_conn->sm_role = packet[6];
3300                             sm_conn->sm_peer_addr_type = packet[7];
3301                             reverse_bd_addr(&packet[8], sm_conn->sm_peer_address);
3302 
3303                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
3304 
3305                             // reset security properties
3306                             sm_conn->sm_connection_encrypted = 0;
3307                             sm_conn->sm_connection_authenticated = 0;
3308                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
3309                             sm_conn->sm_le_db_index = -1;
3310 
3311                             // prepare CSRK lookup (does not involve setup)
3312                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
3313 
3314                             // just connected -> everything else happens in sm_run()
3315                             if (IS_RESPONDER(sm_conn->sm_role)){
3316                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
3317                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3318                                     if (sm_slave_request_security) {
3319                                         // request security if requested by app
3320                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3321                                     } else {
3322                                         // otherwise, wait for pairing request
3323                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3324                                     }
3325                                 }
3326                                 break;
3327                             } else {
3328                                 // master
3329                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3330                             }
3331                             break;
3332 
3333                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
3334                             con_handle = little_endian_read_16(packet, 3);
3335                             sm_conn = sm_get_connection_for_handle(con_handle);
3336                             if (!sm_conn) break;
3337 
3338                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
3339                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
3340                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
3341                                 break;
3342                             }
3343                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
3344                                 // PH2 SEND LTK as we need to exchange keys in PH3
3345                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
3346                                 break;
3347                             }
3348 
3349                             // store rand and ediv
3350                             reverse_64(&packet[5], sm_conn->sm_local_rand);
3351                             sm_conn->sm_local_ediv = little_endian_read_16(packet, 13);
3352 
3353                             // For Legacy Pairing (<=> EDIV != 0 || RAND != NULL), we need to recalculated our LTK as a
3354                             // potentially stored LTK is from the master
3355                             if (sm_conn->sm_local_ediv != 0 || !sm_is_null_random(sm_conn->sm_local_rand)){
3356                                 if (sm_reconstruct_ltk_without_le_device_db_entry){
3357                                     sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
3358                                     break;
3359                                 }
3360                                 // additionally check if remote is in LE Device DB if requested
3361                                 switch(sm_conn->sm_irk_lookup_state){
3362                                     case IRK_LOOKUP_FAILED:
3363                                         log_info("LTK Request: device not in device db");
3364                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
3365                                         break;
3366                                     case IRK_LOOKUP_SUCCEEDED:
3367                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
3368                                         break;
3369                                     default:
3370                                         // wait for irk look doen
3371                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK;
3372                                         break;
3373                                 }
3374                                 break;
3375                             }
3376 
3377 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3378                             sm_conn->sm_engine_state = SM_SC_RECEIVED_LTK_REQUEST;
3379 #else
3380                             log_info("LTK Request: ediv & random are empty, but LE Secure Connections not supported");
3381                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
3382 #endif
3383                             break;
3384 
3385 #if defined(ENABLE_LE_SECURE_CONNECTIONS) && !defined(USE_SOFTWARE_ECDH_IMPLEMENTATION)
3386                         case HCI_SUBEVENT_LE_READ_LOCAL_P256_PUBLIC_KEY_COMPLETE:
3387                             if (hci_subevent_le_read_local_p256_public_key_complete_get_status(packet)){
3388                                 log_error("Read Local P256 Public Key failed");
3389                                 break;
3390                             }
3391 
3392                             hci_subevent_le_read_local_p256_public_key_complete_get_dhkey_x(packet, &ec_q[0]);
3393                             hci_subevent_le_read_local_p256_public_key_complete_get_dhkey_y(packet, &ec_q[32]);
3394 
3395                             ec_key_generation_state = EC_KEY_GENERATION_DONE;
3396                             sm_log_ec_keypair();
3397                             break;
3398                         case HCI_SUBEVENT_LE_GENERATE_DHKEY_COMPLETE:
3399                             sm_conn = sm_get_connection_for_handle(sm_active_connection_handle);
3400                             if (hci_subevent_le_generate_dhkey_complete_get_status(packet)){
3401                                 log_error("Generate DHKEY failed -> abort");
3402                                 // abort pairing with 'unspecified reason'
3403                                 sm_pdu_received_in_wrong_state(sm_conn);
3404                                 break;
3405                             }
3406 
3407                             hci_subevent_le_generate_dhkey_complete_get_dhkey(packet, &setup->sm_dhkey[0]);
3408                             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_CALCULATED;
3409                             log_info("dhkey");
3410                             log_info_hexdump(&setup->sm_dhkey[0], 32);
3411 
3412                             // trigger next step
3413                             if (sm_conn->sm_engine_state == SM_SC_W4_CALCULATE_DHKEY){
3414                                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
3415                             }
3416                             break;
3417 #endif
3418                         default:
3419                             break;
3420                     }
3421                     break;
3422 
3423                 case HCI_EVENT_ENCRYPTION_CHANGE:
3424                     con_handle = little_endian_read_16(packet, 3);
3425                     sm_conn = sm_get_connection_for_handle(con_handle);
3426                     if (!sm_conn) break;
3427 
3428                     sm_conn->sm_connection_encrypted = packet[5];
3429                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
3430                         sm_conn->sm_actual_encryption_key_size);
3431                     log_info("event handler, state %u", sm_conn->sm_engine_state);
3432                     if (!sm_conn->sm_connection_encrypted) break;
3433                     // continue if part of initial pairing
3434                     switch (sm_conn->sm_engine_state){
3435                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
3436                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3437                             sm_done_for_handle(sm_conn->sm_handle);
3438                             break;
3439                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
3440                             if (IS_RESPONDER(sm_conn->sm_role)){
3441                                 // slave
3442                                 if (setup->sm_use_secure_connections){
3443                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3444                                 } else {
3445                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3446                                 }
3447                             } else {
3448                                 // master
3449                                 if (sm_key_distribution_all_received(sm_conn)){
3450                                     // skip receiving keys as there are none
3451                                     sm_key_distribution_handle_all_received(sm_conn);
3452                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3453                                 } else {
3454                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3455                                 }
3456                             }
3457                             break;
3458                         default:
3459                             break;
3460                     }
3461                     break;
3462 
3463                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
3464                     con_handle = little_endian_read_16(packet, 3);
3465                     sm_conn = sm_get_connection_for_handle(con_handle);
3466                     if (!sm_conn) break;
3467 
3468                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
3469                     log_info("event handler, state %u", sm_conn->sm_engine_state);
3470                     // continue if part of initial pairing
3471                     switch (sm_conn->sm_engine_state){
3472                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
3473                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3474                             sm_done_for_handle(sm_conn->sm_handle);
3475                             break;
3476                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
3477                             if (IS_RESPONDER(sm_conn->sm_role)){
3478                                 // slave
3479                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3480                             } else {
3481                                 // master
3482                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3483                             }
3484                             break;
3485                         default:
3486                             break;
3487                     }
3488                     break;
3489 
3490 
3491                 case HCI_EVENT_DISCONNECTION_COMPLETE:
3492                     con_handle = little_endian_read_16(packet, 3);
3493                     sm_done_for_handle(con_handle);
3494                     sm_conn = sm_get_connection_for_handle(con_handle);
3495                     if (!sm_conn) break;
3496 
3497                     // delete stored bonding on disconnect with authentication failure in ph0
3498                     if (sm_conn->sm_role == 0
3499                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
3500                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
3501                         le_device_db_remove(sm_conn->sm_le_db_index);
3502                     }
3503 
3504                     // pairing failed, if it was ongoing
3505                     if (sm_conn->sm_engine_state != SM_INITIATOR_CONNECTED && sm_conn->sm_engine_state != SM_GENERAL_IDLE){
3506                         sm_notify_client_status_reason(sm_conn, ERROR_CODE_REMOTE_USER_TERMINATED_CONNECTION, 0);
3507                     }
3508 
3509                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
3510                     sm_conn->sm_handle = 0;
3511                     break;
3512 
3513 				case HCI_EVENT_COMMAND_COMPLETE:
3514                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_encrypt)){
3515                         sm_handle_encryption_result(&packet[6]);
3516                         break;
3517                     }
3518                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_rand)){
3519                         sm_handle_random_result(&packet[6]);
3520                         break;
3521                     }
3522                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_read_bd_addr)){
3523                         // set local addr for le device db
3524                         bd_addr_t addr;
3525                         reverse_bd_addr(&packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1], addr);
3526                         le_device_db_set_local_bd_addr(addr);
3527                     }
3528                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_read_local_supported_commands)){
3529 #if defined(ENABLE_LE_SECURE_CONNECTIONS) && !defined(USE_SOFTWARE_ECDH_IMPLEMENTATION)
3530                         if ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1+34] & 0x06) != 0x06){
3531                             // mbedTLS can also be used if already available (and malloc is supported)
3532                             log_error("LE Secure Connections enabled, but HCI Controller doesn't support it. Please add USE_MICRO_ECC_FOR_ECDH to btstack_config.h");
3533                         }
3534 #endif
3535                     }
3536                     break;
3537                 default:
3538                     break;
3539 			}
3540             break;
3541         default:
3542             break;
3543 	}
3544 
3545     sm_run();
3546 }
3547 
3548 static inline int sm_calc_actual_encryption_key_size(int other){
3549     if (other < sm_min_encryption_key_size) return 0;
3550     if (other < sm_max_encryption_key_size) return other;
3551     return sm_max_encryption_key_size;
3552 }
3553 
3554 
3555 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3556 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
3557     switch (method){
3558         case JUST_WORKS:
3559         case NK_BOTH_INPUT:
3560             return 1;
3561         default:
3562             return 0;
3563     }
3564 }
3565 // responder
3566 
3567 static int sm_passkey_used(stk_generation_method_t method){
3568     switch (method){
3569         case PK_RESP_INPUT:
3570             return 1;
3571         default:
3572             return 0;
3573     }
3574 }
3575 
3576 static int sm_passkey_entry(stk_generation_method_t method){
3577     switch (method){
3578         case PK_RESP_INPUT:
3579         case PK_INIT_INPUT:
3580         case OK_BOTH_INPUT:
3581             return 1;
3582         default:
3583             return 0;
3584     }
3585 }
3586 
3587 #endif
3588 
3589 /**
3590  * @return ok
3591  */
3592 static int sm_validate_stk_generation_method(void){
3593     // check if STK generation method is acceptable by client
3594     switch (setup->sm_stk_generation_method){
3595         case JUST_WORKS:
3596             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
3597         case PK_RESP_INPUT:
3598         case PK_INIT_INPUT:
3599         case OK_BOTH_INPUT:
3600             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
3601         case OOB:
3602             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
3603         case NK_BOTH_INPUT:
3604             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
3605             return 1;
3606         default:
3607             return 0;
3608     }
3609 }
3610 
3611 // size of complete sm_pdu used to validate input
3612 static const uint8_t sm_pdu_size[] = {
3613     0,  // 0x00 invalid opcode
3614     7,  // 0x01 pairing request
3615     7,  // 0x02 pairing response
3616     17, // 0x03 pairing confirm
3617     17, // 0x04 pairing random
3618     2,  // 0x05 pairing failed
3619     17, // 0x06 encryption information
3620     11, // 0x07 master identification
3621     17, // 0x08 identification information
3622     8,  // 0x09 identify address information
3623     17, // 0x0a signing information
3624     2,  // 0x0b security request
3625     65, // 0x0c pairing public key
3626     17, // 0x0d pairing dhk check
3627     2,  // 0x0e keypress notification
3628 };
3629 
3630 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
3631 
3632     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
3633         sm_run();
3634     }
3635 
3636     if (packet_type != SM_DATA_PACKET) return;
3637     if (size == 0) return;
3638 
3639     uint8_t sm_pdu_code = packet[0];
3640 
3641     // validate pdu size
3642     if (sm_pdu_code >= sizeof(sm_pdu_size)) return;
3643     if (sm_pdu_size[sm_pdu_code] != size)   return;
3644 
3645     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3646     if (!sm_conn) return;
3647 
3648     if (sm_pdu_code == SM_CODE_PAIRING_FAILED){
3649         sm_notify_client_status_reason(sm_conn, ERROR_CODE_AUTHENTICATION_FAILURE, packet[1]);
3650         sm_done_for_handle(con_handle);
3651         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
3652         return;
3653     }
3654 
3655     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, sm_pdu_code);
3656 
3657     int err;
3658     UNUSED(err);
3659 
3660     if (sm_pdu_code == SM_CODE_KEYPRESS_NOTIFICATION){
3661         uint8_t buffer[5];
3662         buffer[0] = SM_EVENT_KEYPRESS_NOTIFICATION;
3663         buffer[1] = 3;
3664         little_endian_store_16(buffer, 2, con_handle);
3665         buffer[4] = packet[1];
3666         sm_dispatch_event(HCI_EVENT_PACKET, 0, buffer, sizeof(buffer));
3667         return;
3668     }
3669 
3670     switch (sm_conn->sm_engine_state){
3671 
3672         // a sm timeout requries a new physical connection
3673         case SM_GENERAL_TIMEOUT:
3674             return;
3675 
3676 #ifdef ENABLE_LE_CENTRAL
3677 
3678         // Initiator
3679         case SM_INITIATOR_CONNECTED:
3680             if ((sm_pdu_code != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
3681                 sm_pdu_received_in_wrong_state(sm_conn);
3682                 break;
3683             }
3684             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
3685                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3686                 break;
3687             }
3688             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
3689                 sm_key_t ltk;
3690                 le_device_db_encryption_get(sm_conn->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
3691                 if (!sm_is_null_key(ltk)){
3692                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3693                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3694                 } else {
3695                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3696                 }
3697                 break;
3698             }
3699             // otherwise, store security request
3700             sm_conn->sm_security_request_received = 1;
3701             break;
3702 
3703         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
3704             if (sm_pdu_code != SM_CODE_PAIRING_RESPONSE){
3705                 sm_pdu_received_in_wrong_state(sm_conn);
3706                 break;
3707             }
3708 
3709             // store pairing request
3710             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3711             err = sm_stk_generation_init(sm_conn);
3712 
3713 #ifdef ENABLE_TESTING_SUPPORT
3714             if (0 < test_pairing_failure && test_pairing_failure < SM_REASON_DHKEY_CHECK_FAILED){
3715                 log_info("testing_support: abort with pairing failure %u", test_pairing_failure);
3716                 err = test_pairing_failure;
3717             }
3718 #endif
3719 
3720             if (err){
3721                 setup->sm_pairing_failed_reason = err;
3722                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3723                 break;
3724             }
3725 
3726             // generate random number first, if we need to show passkey
3727             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3728                 sm_conn->sm_engine_state = SM_PH2_GET_RANDOM_TK;
3729                 break;
3730             }
3731 
3732 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3733             if (setup->sm_use_secure_connections){
3734                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3735                 if (setup->sm_stk_generation_method == JUST_WORKS){
3736                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3737                     sm_trigger_user_response(sm_conn);
3738                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3739                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3740                     }
3741                 } else {
3742                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3743                 }
3744                 break;
3745             }
3746 #endif
3747             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3748             sm_trigger_user_response(sm_conn);
3749             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3750             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3751                 sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3752             }
3753             break;
3754 
3755         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3756             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3757                 sm_pdu_received_in_wrong_state(sm_conn);
3758                 break;
3759             }
3760 
3761             // store s_confirm
3762             reverse_128(&packet[1], setup->sm_peer_confirm);
3763 
3764 #ifdef ENABLE_TESTING_SUPPORT
3765             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
3766                 log_info("testing_support: reset confirm value");
3767                 memset(setup->sm_peer_confirm, 0, 16);
3768             }
3769 #endif
3770             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3771             break;
3772 
3773         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3774             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
3775                 sm_pdu_received_in_wrong_state(sm_conn);
3776                 break;;
3777             }
3778 
3779             // received random value
3780             reverse_128(&packet[1], setup->sm_peer_random);
3781             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3782             break;
3783 #endif
3784 
3785 #ifdef ENABLE_LE_PERIPHERAL
3786         // Responder
3787         case SM_RESPONDER_IDLE:
3788         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3789         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3790             if (sm_pdu_code != SM_CODE_PAIRING_REQUEST){
3791                 sm_pdu_received_in_wrong_state(sm_conn);
3792                 break;;
3793             }
3794 
3795             // store pairing request
3796             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3797             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3798             break;
3799 #endif
3800 
3801 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3802         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3803             if (sm_pdu_code != SM_CODE_PAIRING_PUBLIC_KEY){
3804                 sm_pdu_received_in_wrong_state(sm_conn);
3805                 break;
3806             }
3807 
3808             // store public key for DH Key calculation
3809             reverse_256(&packet[01], &setup->sm_peer_q[0]);
3810             reverse_256(&packet[33], &setup->sm_peer_q[32]);
3811 
3812             // validate public key using micro-ecc
3813             err = 0;
3814 
3815 #ifdef USE_MICRO_ECC_FOR_ECDH
3816 #if uECC_SUPPORTS_secp256r1
3817             // standard version
3818             err = uECC_valid_public_key(setup->sm_peer_q, uECC_secp256r1()) == 0;
3819 #else
3820             // static version
3821             err = uECC_valid_public_key(setup->sm_peer_q) == 0;
3822 #endif
3823 #endif
3824 
3825 #ifdef USE_MBEDTLS_FOR_ECDH
3826             mbedtls_ecp_point Q;
3827             mbedtls_ecp_point_init( &Q );
3828             mbedtls_mpi_read_binary(&Q.X, &setup->sm_peer_q[0], 32);
3829             mbedtls_mpi_read_binary(&Q.Y, &setup->sm_peer_q[32], 32);
3830             mbedtls_mpi_lset(&Q.Z, 1);
3831             err = mbedtls_ecp_check_pubkey(&mbedtls_ec_group, &Q);
3832             mbedtls_ecp_point_free( & Q);
3833 #endif
3834 
3835             if (err){
3836                 log_error("sm: peer public key invalid %x", err);
3837                 // uses "unspecified reason", there is no "public key invalid" error code
3838                 sm_pdu_received_in_wrong_state(sm_conn);
3839                 break;
3840             }
3841 
3842 #ifndef USE_SOFTWARE_ECDH_IMPLEMENTATION
3843             // ask controller to calculate dhkey
3844             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_NEEDED;
3845 #endif
3846 
3847 
3848             log_info("public key received, generation method %u", setup->sm_stk_generation_method);
3849             if (IS_RESPONDER(sm_conn->sm_role)){
3850                 // responder
3851                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3852             } else {
3853                 // initiator
3854                 // stk generation method
3855                 // passkey entry: notify app to show passkey or to request passkey
3856                 switch (setup->sm_stk_generation_method){
3857                     case JUST_WORKS:
3858                     case NK_BOTH_INPUT:
3859                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3860                         break;
3861                     case PK_RESP_INPUT:
3862                         sm_sc_start_calculating_local_confirm(sm_conn);
3863                         break;
3864                     case PK_INIT_INPUT:
3865                     case OK_BOTH_INPUT:
3866                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3867                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3868                             break;
3869                         }
3870                         sm_sc_start_calculating_local_confirm(sm_conn);
3871                         break;
3872                     case OOB:
3873                         // generate Na
3874                         log_info("Generate Na");
3875                         sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3876                         break;
3877                 }
3878             }
3879             break;
3880 
3881         case SM_SC_W4_CONFIRMATION:
3882             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3883                 sm_pdu_received_in_wrong_state(sm_conn);
3884                 break;
3885             }
3886             // received confirm value
3887             reverse_128(&packet[1], setup->sm_peer_confirm);
3888 
3889 #ifdef ENABLE_TESTING_SUPPORT
3890             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
3891                 log_info("testing_support: reset confirm value");
3892                 memset(setup->sm_peer_confirm, 0, 16);
3893             }
3894 #endif
3895             if (IS_RESPONDER(sm_conn->sm_role)){
3896                 // responder
3897                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3898                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3899                         // still waiting for passkey
3900                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3901                         break;
3902                     }
3903                 }
3904                 sm_sc_start_calculating_local_confirm(sm_conn);
3905             } else {
3906                 // initiator
3907                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3908                     sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3909                 } else {
3910                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3911                 }
3912             }
3913             break;
3914 
3915         case SM_SC_W4_PAIRING_RANDOM:
3916             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
3917                 sm_pdu_received_in_wrong_state(sm_conn);
3918                 break;
3919             }
3920 
3921             // received random value
3922             reverse_128(&packet[1], setup->sm_peer_nonce);
3923 
3924             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3925             // only check for JUST WORK/NC in initiator role OR passkey entry
3926             if ( (!IS_RESPONDER(sm_conn->sm_role) && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method))
3927             ||   (sm_passkey_used(setup->sm_stk_generation_method)) ) {
3928                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3929                  break;
3930             }
3931 
3932             // OOB
3933             if (setup->sm_stk_generation_method == OOB){
3934 
3935                 // setup local random, set to zero if remote did not receive our data
3936                 log_info("Received nonce, setup local random ra/rb for dhkey check");
3937                 if (IS_RESPONDER(sm_conn->sm_role)){
3938                     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) == 0){
3939                         log_info("Reset rb as A does not have OOB data");
3940                         memset(setup->sm_rb, 0, 16);
3941                     } else {
3942                         memcpy(setup->sm_rb, sm_sc_oob_random, 16);
3943                         log_info("Use stored rb");
3944                         log_info_hexdump(setup->sm_rb, 16);
3945                     }
3946                 }  else {
3947                     if (sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres) == 0){
3948                         log_info("Reset ra as B does not have OOB data");
3949                         memset(setup->sm_ra, 0, 16);
3950                     } else {
3951                         memcpy(setup->sm_ra, sm_sc_oob_random, 16);
3952                         log_info("Use stored ra");
3953                         log_info_hexdump(setup->sm_ra, 16);
3954                     }
3955                 }
3956 
3957                 // validate confirm value if Cb = f4(PKb, Pkb, rb, 0) for OOB if data received
3958                 if (setup->sm_have_oob_data){
3959                      sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3960                      break;
3961                 }
3962             }
3963 
3964             // TODO: we only get here for Responder role with JW/NC
3965             sm_sc_state_after_receiving_random(sm_conn);
3966             break;
3967 
3968         case SM_SC_W2_CALCULATE_G2:
3969         case SM_SC_W4_CALCULATE_G2:
3970         case SM_SC_W4_CALCULATE_DHKEY:
3971         case SM_SC_W2_CALCULATE_F5_SALT:
3972         case SM_SC_W4_CALCULATE_F5_SALT:
3973         case SM_SC_W2_CALCULATE_F5_MACKEY:
3974         case SM_SC_W4_CALCULATE_F5_MACKEY:
3975         case SM_SC_W2_CALCULATE_F5_LTK:
3976         case SM_SC_W4_CALCULATE_F5_LTK:
3977         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3978         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3979         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3980             if (sm_pdu_code != SM_CODE_PAIRING_DHKEY_CHECK){
3981                 sm_pdu_received_in_wrong_state(sm_conn);
3982                 break;
3983             }
3984             // store DHKey Check
3985             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3986             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3987 
3988             // have we been only waiting for dhkey check command?
3989             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3990                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3991             }
3992             break;
3993 #endif
3994 
3995 #ifdef ENABLE_LE_PERIPHERAL
3996         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3997             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3998                 sm_pdu_received_in_wrong_state(sm_conn);
3999                 break;
4000             }
4001 
4002             // received confirm value
4003             reverse_128(&packet[1], setup->sm_peer_confirm);
4004 
4005 #ifdef ENABLE_TESTING_SUPPORT
4006             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
4007                 log_info("testing_support: reset confirm value");
4008                 memset(setup->sm_peer_confirm, 0, 16);
4009             }
4010 #endif
4011             // notify client to hide shown passkey
4012             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
4013                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
4014             }
4015 
4016             // handle user cancel pairing?
4017             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
4018                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEY_ENTRY_FAILED;
4019                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
4020                 break;
4021             }
4022 
4023             // wait for user action?
4024             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
4025                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
4026                 break;
4027             }
4028 
4029             // calculate and send local_confirm
4030             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
4031             break;
4032 
4033         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
4034             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
4035                 sm_pdu_received_in_wrong_state(sm_conn);
4036                 break;;
4037             }
4038 
4039             // received random value
4040             reverse_128(&packet[1], setup->sm_peer_random);
4041             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
4042             break;
4043 #endif
4044 
4045         case SM_PH3_RECEIVE_KEYS:
4046             switch(sm_pdu_code){
4047                 case SM_CODE_ENCRYPTION_INFORMATION:
4048                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
4049                     reverse_128(&packet[1], setup->sm_peer_ltk);
4050                     break;
4051 
4052                 case SM_CODE_MASTER_IDENTIFICATION:
4053                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
4054                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
4055                     reverse_64(&packet[3], setup->sm_peer_rand);
4056                     break;
4057 
4058                 case SM_CODE_IDENTITY_INFORMATION:
4059                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
4060                     reverse_128(&packet[1], setup->sm_peer_irk);
4061                     break;
4062 
4063                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
4064                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
4065                     setup->sm_peer_addr_type = packet[1];
4066                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
4067                     break;
4068 
4069                 case SM_CODE_SIGNING_INFORMATION:
4070                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
4071                     reverse_128(&packet[1], setup->sm_peer_csrk);
4072                     break;
4073                 default:
4074                     // Unexpected PDU
4075                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
4076                     break;
4077             }
4078             // done with key distribution?
4079             if (sm_key_distribution_all_received(sm_conn)){
4080 
4081                 sm_key_distribution_handle_all_received(sm_conn);
4082 
4083                 if (IS_RESPONDER(sm_conn->sm_role)){
4084                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
4085                         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
4086                     } else {
4087                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
4088                         sm_notify_client_status_reason(sm_conn, ERROR_CODE_SUCCESS, 0);
4089                         sm_done_for_handle(sm_conn->sm_handle);
4090                     }
4091                 } else {
4092                     if (setup->sm_use_secure_connections){
4093                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
4094                     } else {
4095                         sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
4096                     }
4097                 }
4098             }
4099             break;
4100         default:
4101             // Unexpected PDU
4102             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
4103             break;
4104     }
4105 
4106     // try to send preparared packet
4107     sm_run();
4108 }
4109 
4110 // Security Manager Client API
4111 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t address_type, bd_addr_t addr, uint8_t * oob_data)){
4112     sm_get_oob_data = get_oob_data_callback;
4113 }
4114 
4115 void sm_register_sc_oob_data_callback( int (*get_sc_oob_data_callback)(uint8_t address_type, bd_addr_t addr, uint8_t * oob_sc_peer_confirm, uint8_t * oob_sc_peer_random)){
4116     sm_get_sc_oob_data = get_sc_oob_data_callback;
4117 }
4118 
4119 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
4120     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
4121 }
4122 
4123 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
4124     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
4125 }
4126 
4127 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
4128 	sm_min_encryption_key_size = min_size;
4129 	sm_max_encryption_key_size = max_size;
4130 }
4131 
4132 void sm_set_authentication_requirements(uint8_t auth_req){
4133 #ifndef ENABLE_LE_SECURE_CONNECTIONS
4134     if (auth_req & SM_AUTHREQ_SECURE_CONNECTION){
4135         log_error("ENABLE_LE_SECURE_CONNECTIONS not defined, but requested by app. Dropping SC flag");
4136         auth_req &= ~SM_AUTHREQ_SECURE_CONNECTION;
4137     }
4138 #endif
4139     sm_auth_req = auth_req;
4140 }
4141 
4142 void sm_set_io_capabilities(io_capability_t io_capability){
4143     sm_io_capabilities = io_capability;
4144 }
4145 
4146 #ifdef ENABLE_LE_PERIPHERAL
4147 void sm_set_request_security(int enable){
4148     sm_slave_request_security = enable;
4149 }
4150 #endif
4151 
4152 void sm_set_er(sm_key_t er){
4153     memcpy(sm_persistent_er, er, 16);
4154 }
4155 
4156 void sm_set_ir(sm_key_t ir){
4157     memcpy(sm_persistent_ir, ir, 16);
4158 }
4159 
4160 // Testing support only
4161 void sm_test_set_irk(sm_key_t irk){
4162     memcpy(sm_persistent_irk, irk, 16);
4163     sm_persistent_irk_ready = 1;
4164 }
4165 
4166 void sm_test_use_fixed_local_csrk(void){
4167     test_use_fixed_local_csrk = 1;
4168 }
4169 
4170 #ifdef ENABLE_TESTING_SUPPORT
4171 void sm_test_set_pairing_failure(int reason){
4172     test_pairing_failure = reason;
4173 }
4174 #endif
4175 
4176 void sm_init(void){
4177     // set some (BTstack default) ER and IR
4178     int i;
4179     sm_key_t er;
4180     sm_key_t ir;
4181     for (i=0;i<16;i++){
4182         er[i] = 0x30 + i;
4183         ir[i] = 0x90 + i;
4184     }
4185     sm_set_er(er);
4186     sm_set_ir(ir);
4187     // defaults
4188     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
4189                                        | SM_STK_GENERATION_METHOD_OOB
4190                                        | SM_STK_GENERATION_METHOD_PASSKEY
4191                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
4192 
4193     sm_max_encryption_key_size = 16;
4194     sm_min_encryption_key_size = 7;
4195 
4196     sm_fixed_passkey_in_display_role = 0xffffffff;
4197     sm_reconstruct_ltk_without_le_device_db_entry = 1;
4198 
4199 #ifdef ENABLE_CMAC_ENGINE
4200     sm_cmac_state  = CMAC_IDLE;
4201 #endif
4202     dkg_state = DKG_W4_WORKING;
4203     rau_state = RAU_W4_WORKING;
4204     sm_aes128_state = SM_AES128_IDLE;
4205     sm_address_resolution_test = -1;    // no private address to resolve yet
4206     sm_address_resolution_ah_calculation_active = 0;
4207     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
4208     sm_address_resolution_general_queue = NULL;
4209 
4210     gap_random_adress_update_period = 15 * 60 * 1000L;
4211     sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
4212 
4213     test_use_fixed_local_csrk = 0;
4214 
4215     // register for HCI Events from HCI
4216     hci_event_callback_registration.callback = &sm_event_packet_handler;
4217     hci_add_event_handler(&hci_event_callback_registration);
4218 
4219     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
4220     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
4221 
4222 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4223     ec_key_generation_state = EC_KEY_GENERATION_IDLE;
4224 #endif
4225 
4226 #ifdef USE_MBEDTLS_FOR_ECDH
4227     mbedtls_ecp_group_init(&mbedtls_ec_group);
4228     mbedtls_ecp_group_load(&mbedtls_ec_group, MBEDTLS_ECP_DP_SECP256R1);
4229 #endif
4230 }
4231 
4232 void sm_use_fixed_ec_keypair(uint8_t * qx, uint8_t * qy, uint8_t * d){
4233 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4234     memcpy(&ec_q[0],  qx, 32);
4235     memcpy(&ec_q[32], qy, 32);
4236     memcpy(ec_d, d, 32);
4237     sm_have_ec_keypair = 1;
4238     ec_key_generation_state = EC_KEY_GENERATION_DONE;
4239 #else
4240     UNUSED(qx);
4241     UNUSED(qy);
4242     UNUSED(d);
4243 #endif
4244 }
4245 
4246 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4247 static void parse_hex(uint8_t * buffer, const char * hex_string){
4248     while (*hex_string){
4249         int high_nibble = nibble_for_char(*hex_string++);
4250         int low_nibble  = nibble_for_char(*hex_string++);
4251         *buffer++       = (high_nibble << 4) | low_nibble;
4252     }
4253 }
4254 #endif
4255 
4256 void sm_test_use_fixed_ec_keypair(void){
4257 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4258     const char * ec_d_string =  "3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd";
4259     const char * ec_qx_string = "20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6";
4260     const char * ec_qy_string = "dc809c49652aeb6d63329abf5a52155c766345c28fed3024741c8ed01589d28b";
4261     parse_hex(ec_d, ec_d_string);
4262     parse_hex(&ec_q[0],  ec_qx_string);
4263     parse_hex(&ec_q[32], ec_qy_string);
4264     sm_have_ec_keypair = 1;
4265     ec_key_generation_state = EC_KEY_GENERATION_DONE;
4266 #endif
4267 }
4268 
4269 void sm_use_fixed_passkey_in_display_role(uint32_t passkey){
4270     sm_fixed_passkey_in_display_role = passkey;
4271 }
4272 
4273 void sm_allow_ltk_reconstruction_without_le_device_db_entry(int allow){
4274     sm_reconstruct_ltk_without_le_device_db_entry = allow;
4275 }
4276 
4277 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
4278     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
4279     if (!hci_con) return NULL;
4280     return &hci_con->sm_connection;
4281 }
4282 
4283 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
4284     switch (sm_conn->sm_engine_state){
4285         case SM_GENERAL_IDLE:
4286         case SM_RESPONDER_IDLE:
4287             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
4288             sm_run();
4289             break;
4290         default:
4291             break;
4292     }
4293 }
4294 
4295 /**
4296  * @brief Trigger Security Request
4297  */
4298 void sm_send_security_request(hci_con_handle_t con_handle){
4299     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4300     if (!sm_conn) return;
4301     sm_send_security_request_for_connection(sm_conn);
4302 }
4303 
4304 // request pairing
4305 void sm_request_pairing(hci_con_handle_t con_handle){
4306     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4307     if (!sm_conn) return;     // wrong connection
4308 
4309     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
4310     if (IS_RESPONDER(sm_conn->sm_role)){
4311         sm_send_security_request_for_connection(sm_conn);
4312     } else {
4313         // used as a trigger to start central/master/initiator security procedures
4314         uint16_t ediv;
4315         sm_key_t ltk;
4316         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
4317             switch (sm_conn->sm_irk_lookup_state){
4318                 case IRK_LOOKUP_FAILED:
4319                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
4320                     break;
4321                 case IRK_LOOKUP_SUCCEEDED:
4322                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
4323                         if (!sm_is_null_key(ltk) || ediv){
4324                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
4325                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
4326                         } else {
4327                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
4328                         }
4329                         break;
4330                 default:
4331                     sm_conn->sm_pairing_requested = 1;
4332                     break;
4333             }
4334         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
4335             sm_conn->sm_pairing_requested = 1;
4336         }
4337     }
4338     sm_run();
4339 }
4340 
4341 // called by client app on authorization request
4342 void sm_authorization_decline(hci_con_handle_t con_handle){
4343     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4344     if (!sm_conn) return;     // wrong connection
4345     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
4346     sm_notify_client_status(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
4347 }
4348 
4349 void sm_authorization_grant(hci_con_handle_t con_handle){
4350     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4351     if (!sm_conn) return;     // wrong connection
4352     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
4353     sm_notify_client_status(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
4354 }
4355 
4356 // GAP Bonding API
4357 
4358 void sm_bonding_decline(hci_con_handle_t con_handle){
4359     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4360     if (!sm_conn) return;     // wrong connection
4361     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
4362     log_info("decline, state %u", sm_conn->sm_engine_state);
4363     switch(sm_conn->sm_engine_state){
4364 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4365         case SM_SC_W4_USER_RESPONSE:
4366         case SM_SC_W4_CONFIRMATION:
4367         case SM_SC_W4_PUBLIC_KEY_COMMAND:
4368 #endif
4369         case SM_PH1_W4_USER_RESPONSE:
4370             switch (setup->sm_stk_generation_method){
4371                 case PK_RESP_INPUT:
4372                 case PK_INIT_INPUT:
4373                 case OK_BOTH_INPUT:
4374                     sm_pairing_error(sm_conn, SM_REASON_PASSKEY_ENTRY_FAILED);
4375                     break;
4376                 case NK_BOTH_INPUT:
4377                     sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
4378                     break;
4379                 case JUST_WORKS:
4380                 case OOB:
4381                     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
4382                     break;
4383             }
4384             break;
4385         default:
4386             break;
4387     }
4388     sm_run();
4389 }
4390 
4391 void sm_just_works_confirm(hci_con_handle_t con_handle){
4392     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4393     if (!sm_conn) return;     // wrong connection
4394     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
4395     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
4396         if (setup->sm_use_secure_connections){
4397             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
4398         } else {
4399             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
4400         }
4401     }
4402 
4403 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4404     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
4405         sm_sc_prepare_dhkey_check(sm_conn);
4406     }
4407 #endif
4408 
4409     sm_run();
4410 }
4411 
4412 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
4413     // for now, it's the same
4414     sm_just_works_confirm(con_handle);
4415 }
4416 
4417 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
4418     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4419     if (!sm_conn) return;     // wrong connection
4420     sm_reset_tk();
4421     big_endian_store_32(setup->sm_tk, 12, passkey);
4422     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
4423     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
4424         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
4425     }
4426 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4427     memcpy(setup->sm_ra, setup->sm_tk, 16);
4428     memcpy(setup->sm_rb, setup->sm_tk, 16);
4429     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
4430         sm_sc_start_calculating_local_confirm(sm_conn);
4431     }
4432 #endif
4433     sm_run();
4434 }
4435 
4436 void sm_keypress_notification(hci_con_handle_t con_handle, uint8_t action){
4437     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4438     if (!sm_conn) return;     // wrong connection
4439     if (action > SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED) return;
4440     uint8_t num_actions = setup->sm_keypress_notification >> 5;
4441     uint8_t flags = setup->sm_keypress_notification & 0x1f;
4442     switch (action){
4443         case SM_KEYPRESS_PASSKEY_ENTRY_STARTED:
4444         case SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED:
4445             flags |= (1 << action);
4446             break;
4447         case SM_KEYPRESS_PASSKEY_CLEARED:
4448             // clear counter, keypress & erased flags + set passkey cleared
4449             flags = (flags & 0x19) | (1 << SM_KEYPRESS_PASSKEY_CLEARED);
4450             break;
4451         case SM_KEYPRESS_PASSKEY_DIGIT_ENTERED:
4452             if (flags & (1 << SM_KEYPRESS_PASSKEY_DIGIT_ERASED)){
4453                 // erase actions queued
4454                 num_actions--;
4455                 if (num_actions == 0){
4456                     // clear counter, keypress & erased flags
4457                     flags &= 0x19;
4458                 }
4459                 break;
4460             }
4461             num_actions++;
4462             flags |= (1 << SM_KEYPRESS_PASSKEY_DIGIT_ENTERED);
4463             break;
4464         case SM_KEYPRESS_PASSKEY_DIGIT_ERASED:
4465             if (flags & (1 << SM_KEYPRESS_PASSKEY_DIGIT_ENTERED)){
4466                 // enter actions queued
4467                 num_actions--;
4468                 if (num_actions == 0){
4469                     // clear counter, keypress & erased flags
4470                     flags &= 0x19;
4471                 }
4472                 break;
4473             }
4474             num_actions++;
4475             flags |= (1 << SM_KEYPRESS_PASSKEY_DIGIT_ERASED);
4476             break;
4477         default:
4478             break;
4479     }
4480     setup->sm_keypress_notification = (num_actions << 5) | flags;
4481     sm_run();
4482 }
4483 
4484 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4485 uint8_t sm_generate_sc_oob_data(void (*callback)(const uint8_t * confirm_value, const uint8_t * random_value)){
4486     if (sm_sc_oob_state != SM_SC_OOB_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
4487     sm_sc_oob_callback = callback;
4488     sm_sc_oob_state = SM_SC_OOB_W2_GET_RANDOM_1;
4489     sm_run();
4490     return 0;
4491 }
4492 #endif
4493 
4494 /**
4495  * @brief Identify device in LE Device DB
4496  * @param handle
4497  * @returns index from le_device_db or -1 if not found/identified
4498  */
4499 int sm_le_device_index(hci_con_handle_t con_handle ){
4500     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4501     if (!sm_conn) return -1;
4502     return sm_conn->sm_le_db_index;
4503 }
4504 
4505 static int gap_random_address_type_requires_updates(void){
4506     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
4507     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
4508     return 1;
4509 }
4510 
4511 static uint8_t own_address_type(void){
4512     switch (gap_random_adress_type){
4513         case GAP_RANDOM_ADDRESS_TYPE_OFF:
4514             return BD_ADDR_TYPE_LE_PUBLIC;
4515         default:
4516             return BD_ADDR_TYPE_LE_RANDOM;
4517     }
4518 }
4519 
4520 // GAP LE API
4521 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
4522     gap_random_address_update_stop();
4523     gap_random_adress_type = random_address_type;
4524     hci_le_set_own_address_type(own_address_type());
4525     if (!gap_random_address_type_requires_updates()) return;
4526     gap_random_address_update_start();
4527     gap_random_address_trigger();
4528 }
4529 
4530 gap_random_address_type_t gap_random_address_get_mode(void){
4531     return gap_random_adress_type;
4532 }
4533 
4534 void gap_random_address_set_update_period(int period_ms){
4535     gap_random_adress_update_period = period_ms;
4536     if (!gap_random_address_type_requires_updates()) return;
4537     gap_random_address_update_stop();
4538     gap_random_address_update_start();
4539 }
4540 
4541 void gap_random_address_set(bd_addr_t addr){
4542     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_STATIC);
4543     memcpy(sm_random_address, addr, 6);
4544     if (rau_state == RAU_W4_WORKING) return;
4545     rau_state = RAU_SET_ADDRESS;
4546     sm_run();
4547 }
4548 
4549 #ifdef ENABLE_LE_PERIPHERAL
4550 /*
4551  * @brief Set Advertisement Paramters
4552  * @param adv_int_min
4553  * @param adv_int_max
4554  * @param adv_type
4555  * @param direct_address_type
4556  * @param direct_address
4557  * @param channel_map
4558  * @param filter_policy
4559  *
4560  * @note own_address_type is used from gap_random_address_set_mode
4561  */
4562 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
4563     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
4564     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type,
4565         direct_address_typ, direct_address, channel_map, filter_policy);
4566 }
4567 #endif
4568